Forget the Data, Keep the Capability: Switchable Unlearning for Retrieval

Introduction

Machine unlearning removes the influence of specific training samples so that a model behaves as if it had never seen them [2, 3]. Privacy regulations increasingly require this capability, allowing individuals to request deletion of their personal data [45]. This requirement is particularly challenging for person and vehicle re-identification, where models learn identity-specific representations from large-scale datasets [18, 53]. Once deployed, these representations are embedded in the model parameters, making selective deletion without degrading recognition performance a fundamental challenge.

Existing methods remove influence only after training, by which point it is spread through the parameters and exact removal is intractable without retraining. As Figure 1 illustrates, the outcomes divide in three. Methods that preserve retrieval either keep a strong membership signal, as a low-rank LoRA adapter [20] and retain-set fine-tuning [46] do, or drive it past the reference rather than to it, as SSD [13] and LOFT [12] do, which leaves them as indistinguishable as a signal equally far above. Methods that move the signal toward the reference do so by collapsing retrieval, as LoTUS [41] and MUNBa [47] do, and stop short of it even so. Retraining from scratch reaches the reference by definition but discards everything the forgotten data taught.

Retrieval adds a further difficulty, which Figure 2 makes concrete. A deleted class in classification is one of the model’s own output categories, so the request names a unit the model has and removal, while not free, has a target. Re-identification is evaluated on identities the model never saw, so nothing in the output corresponds to the person being deleted, and a model retrained without person 208 ranks another image of them first 96.8% of the time. What that person contributed is embedding geometry built from pairwise constraints against every other identity, and the same geometry is what retrieves the unseen identities the model is tested on. Deletion there removes influence from a space the model has to keep using, and performance on the deleted data is not what says whether it happened.

The cause is structural. A post-hoc method starts from weights that already carry the forget set, so it offers an approximation of removal rather than a guarantee. Acting during training keeps the forget set’s gradients out of the deployed parameters, so the dependence never forms and removal becomes provable up to paths outside the gradient. Re-identification is a natural setting for this, since the party that trains the model is the data controller obliged to honor the request, so the deletion set is known before training begins. It also settles the reference. The deleted images contribute real accuracy, so a model that still performs like the one trained on everything has not given that contribution up, and a method is credible when it lands on the model retrained without the deleted data.

Our key observation is that the two models a deletion request puts in tension can share one backbone. We propose Mixture of Mode Experts (MoME), which augments the normalization affines and the linear maps with parasitic parameters that carry the full-data knowledge, and trains them under gradient isolation so the core parameters never receive a forget-set gradient. Disabling the branch at inference yields Core, provably independent of the forget set up to an audited set of coupling channels and reading at a retrained reference under three membership attacks and the Forgetting-Rank statistic, within what these benchmarks resolve. Enabling it yields Full, which recovers what the deleted data taught, so honoring the request is a flag flip rather than a retraining run. The mechanism is not specific to retrieval and carries to a ResNet-50 backbone, to CLIP, and to class deletion on CIFAR-10.

We have three main contributions as follows:

• We formulate unlearning for retrieval, where the deleted target is not an output category, so removal is certified against genuine retrains rather than by performance on the forget set.

• We propose MoME, which adapts existing pre-trained backbones for privacy compliance by isolating full-data knowledge in zero-initialized parasitic parameters attached to affine LayerNorm and BatchNorm [22] layers. Under gradient isolation, the backbone switches between Full and Core modes, while Core remains independent of the forget set except through an audited set of coupling channels.

• We introduce Forgetting-Rank $\rho_{\nu}$, a rank statistic whose null is $\frac{1}{2}$ under exchangeability, testing whether forgotten samples incur losses consistent with models that never trained on them. We use it with three membership attacks to show on Market-1501, VeRi-776 and RegDB that Core reads at a retrained reference while retrieving above it, and that Full recovers the full-data accuracy.

Related Work

Machine Unlearning

Approaches divide by how much they guarantee [2, 3, 34]. Exact methods partition data into independent shards [2, 14] but scale poorly to modern architectures, and certified removal bounds the influence that may remain [17, 38]. Approximate methods act on a trained model and include fine-tuning on the retain set [46], gradient ascent on the forget set [44], random relabeling [16], corrections from influence functions [24], distillation from a teacher that diverges on the forget set [8, 26], saliency-guided weight selection [11], dampening the synapses a sample relies on [13], instance-wise unlearning on pre-trained classifiers [5], sparsity [23], and Fisher forgetting [15]. The recent state of the art follows the same pattern, with LoTUS [41] calibrating output uncertainty to an information-theoretic bound, MUNBa [47] resolving the forget and retain gradient conflict by Nash bargaining, and LOFT [12] projecting features onto a low dimensional subspace.

All of them are built and scored on classification, where the forgotten target is one of the model’s output categories. The protocol that has settled around that setting reads accuracy on the forget set, accuracy on the retain and test sets, and a membership attack together [11, 23, 26], and the first of those is at once the forgetting signal and a loss of utility. Retrieval does not admit that pairing, so the same suite cannot score it and a certificate there rests on the membership axis alone.

A concurrent work, MUNKEY [27] also unlearns by design, routing memorization into a per-instance key so that deleting the key forgets that instance with no weight update. Its unit is one training instance, its evaluation is classification, and the weights left after a key is deleted carry no independence statement, which is what a deletion request asks of a retrieval model whose deployed parameters are what ships.

Re-Identification and Identity Deletion

Re-identification retrieves a person or vehicle across non-overlapping cameras and has evolved from metric learning with CNNs [30, 53] through part-based models and strong CNN baselines [32, 42, 50] to Vision Transformers such as TransReID [18], with cross-modal extensions [28, 33, 48, 49] requiring invariance between visible and infrared cameras. The privacy of the identities such a model memorizes remains underexplored.

Two efforts come close. De-ReID [35] solves inference-time identity rejection, where a variation-guided objective shifts the retrieval behavior of a fixed trained model so that designated persons are no longer matched, but the target identities stay in the training data, the weights keep the memory derived from them, and it is neither aimed at nor evaluated against membership inference. TIU-ReID [7] removes a target identity with a removable memory adapter and, like MoME, exposes a removal mode obtained by deleting a component at inference, but its adapter is fitted to a backbone that already trained on that identity, so the weights left after removal have seen it. The three positions differ in whether the weights that ship ever saw the forget set, and only MoME’s never did.

Method

MoME consists of three components. Parasitic parameters turn a single backbone into two switchable modes, while gradient isolation ensures that Core receives no gradient from the forget set, providing the basis for the unlearning guarantee. A consolidation stage then recovers the Full payload from the parameter difference relative to the original model. Finally, Forgetting-Rank $\rho_U$ audits the resulting forgetting behavior on the trained model.

Preliminaries

Problem formulation. Let $\mathcal{D}_f$ be the full training set of a person or vehicle re-identification model. A deletion request names a set of training identities rather than a category the model predicts, so what has to go is their contribution to the weights and not the model’s ability to match people. The forget set $U$ holds every image of those identities, none of them survives in the retain set $\mathcal{D}_r$, and the controller keeps only $k$ images per retained identity as a prototype set for continued service. The three sets do not partition $\mathcal{D}_f$. The images of retained identities beyond the $k$ kept, 4972 of 12936 on Market-1501, are named by no request and trained on by neither Core nor the reference, and membership is evaluated on $U$ alone. This matches how deletion arrives in re-identification, where a person revokes consent and all of their images must go, and the thin retain set is where retraining costs most. The retrained reference trains from scratch on $\mathcal{D}_r$ alone and so never observed $U$. The target is a model whose membership behavior on $U$ is indistinguishable from it at competitive retrieval accuracy.

Baseline architecture. We adopt TransReID [18] on a ViT-B/16 backbone [10] at stride 12, whose five branches give a 3840-dimensional descriptor at inference.

Parasitic Parameter Mechanism

Retraining from scratch on $\mathcal{D}_r$ guarantees privacy but discards what the full dataset taught. We observe that additive parameters attached to existing layers can be excluded from the forward pass exactly, which turns one backbone into a switchable pair of models. This motivates parasitic parameters, additive terms injected into the backbone and toggled at inference, as Figure 3 illustrates. During training the branch hosts the Full mode of the two step procedure below; a consolidation stage then refits the slot toward the original model.

Formally, standard Layer Normalization [1] computes

where $\boldsymbol{\gamma}$ and $\boldsymbol{\beta}$ are learnable affine parameters. We augment each Layer Normalization with a pair of parasitic parameters $\boldsymbol{\gamma}_m$ and $\boldsymbol{\beta}_m$, both initialized to zero so that the initial model behavior is unchanged. The augmented forward pass becomes

Switching between the two modes is controlled by a single Boolean flag that enables or disables the parasitic branch across all augmented layers; in Core mode, the parasitic terms are excluded from the computation graph.

Within the backbone, the shadows attach to the Layer-Norm layers preceding attention and the FFN in each Transformer block, as well as to the final normalization layer. Because LayerNorm affine parameters are diagonal, they only rescale the channels produced by the core and cannot mix them; we therefore extend the same additive principle to the linear projections. Each attention and FFN projection receives a zero-initialized low-rank branch following LoRA [20], which is active only in Full mode, giving $\mathbf{W}\mathbf{x}$ in Core mode and $\mathbf{W}\mathbf{x}+\frac{s}{r}\mathbf{B}\mathbf{A}\mathbf{x}$ in Full mode, where $s$ is the scale and $\mathbf{B}$ is initialized to zero. This construction leaves Core bit-identical to the unaugmented network while making Full identical to Core at initialization. Because the parasitic branches cannot affect Core and their rank determines the additional capacity available to Full, safety and capacity can be controlled independently.

Gradient Isolation

Parasitic parameters provide the switchable parameterization but do not by themselves guarantee forgetting. If both modes are trained on the full dataset, the forget set can still update the shared backbone, leaving Core dependent on forgotten samples. The guarantee therefore comes from gradient isolation, which restricts each data source to its designated parameter set.

Let $\theta_c$ denote the core parameters and $\theta_p$ the parasitic parameters. Each iteration consists of two forward-backward passes followed by a single optimizer step. In Step 1, we disable the parasitic branch, process a retain batch in Core mode with classification heads restricted to retained identities, and compute gradients only for $\theta_c$. Thus, forgotten identities produce no updates to Core. In Step 2, we freeze $\theta_c$, process a batch from $D_f$ in Full mode, and compute gradients only for $\theta_p$:

One step then applies both, $\theta_c \leftarrow\theta_c-\eta g_c$ and $\theta_p \leftarrow\theta_p-\alpha\eta g_p$. Step 2 uses all of $D_f$ rather than $U$ alone, since the branch complements Core. Every core gradient therefore comes from $D_r$, and Core mode never evaluates $\theta_p$.

The Full payload. The mechanism provides a separate additive parameter branch that is trained in two stages. During co-training, the branch is optimized for Step 2. Once the Core converges, a consolidation stage initializes each branch from its corresponding slice of $\theta_{\mathrm{orig}}-\theta_c$, the parameter difference between the original model and the Core, and fine-tunes the branch on $D_f$ while keeping the Core frozen. Batch Normalization statistics are the only state that is stored separately rather than represented as an additive parameter difference, since running estimates do not compose additively; the payload therefore stores the original statistics, and the mode switch selects between the two sets. This initialization is important because a zero-initialized branch must learn the entire parameter difference, whereas a branch initialized from that difference only needs to refine it. The Core remains bit-identical during consolidation because $\theta_c$ is frozen throughout this stage. The resulting payload is dense because it stores the refined parameter difference without sparsification.

A gradient is not the only path by which data can influence model state. The backbone uses LayerNorm and maintains no running buffers, leaving the Batch Normalization layers in the classification heads as the only state outside the gradient path; Step 2 updates these statistics when the heads are left unfrozen. These statistics do not affect the Core representation: they carry no gradient, training normalizes using the current batch, and retrieval reads the feature before the BNNeck, so perturbing the running statistics leaves that feature bitwise unchanged. They do, however, affect the classifier logits exposed to the attacks, meaning that the attack surface is strictly larger than the released representation. For BatchNorm backbones, the running statistics can absorb information from $\mathcal{D}_f$, so freezing these statistics is necessary to close this additional information path.

Core is produced by a single end-to-end training stage initialized from ImageNet weights, without an adversarial objective or a separately trained student. After this stage, responding to the deletion request requires only disabling the Full branch. A later request targeting identities already encoded in the Core is a different problem: the mode switch cannot remove an influence already present in $\theta_c$, so applying the isolation mechanism after training does not reach the required operating point and provides no corresponding guarantee. For privacy compliance, only Core is released after deletion; the Full payload remains with the controller. Enabling the payload restores the removed capability, so the deletion guarantee applies to Core alone.

Objective. Both steps optimize the standard re-identification objective, a label-smoothed identity loss on each branch head [43] together with a soft-margin triplet loss on the BNNeck features [19, 32]. Step 1 adds the distillation term above. Nothing in the objective is specific to unlearning: the separation between the two modes comes entirely from which parameters each step is allowed to move.

Auditing the Guarantee: Forgetting-Rank

Gradient isolation guarantees forgetting by construction, but its effect must still be validated on the trained model. A reference-based attack tests whether Core is distinguishable from a retrained model, but this comparison conflates forgetting with generalization because co-training can yield lower loss on forgotten samples than vanilla retraining. We therefore introduce Forgetting-Rank, a model-class-calibrated statistic that instead tests whether Core is exchangeable with models trained under the same procedure.

Let $\ell(x;\theta)$ denote the per-example cross-entropy, and let $\theta^{(1)},\ldots,\theta^{(R)}$ denote shadow models trained using the same procedure. For each sample $x$, let $S(x)$ denote the shadows whose retain sets exclude $x$. On the retrieval benchmarks, all shadows share the same split, so $S(x)$ contains the full shadow set for every forgotten sample and exchangeability is evaluated over training randomness. On the classification benchmark, each shadow independently resamples the deleted classes, so $S(x)$ varies across samples and a sample is evaluated only when at least two shadows exclude it. For each forgotten sample, we rank the target model against the shadows that also exclude that sample,

the average normalized rank of the target’s score, writing $\ell_c(x)=\ell(x;\theta_c)$ and $\ell_j(x)=\ell(x;\theta^{(j)})$. These are assigned their mid-rank; for any $m$ exchangeable scores, the normalized mid-ranks sum to $m/2$, so their mean is $\frac{1}{2}$ regardless of ties, whereas strict inequalities would assign tied scores an arbitrarily low rank. If Core is exchangeable with its shadows for every $x \in U$, as guaranteed by gradient isolation, each rank is uniform and $\mathbb{E}[\rho_U]=\frac{1}{2}$ exactly, without distributional assumptions.

The statistic also detects controlled violations of forgetting. We train audit controls that retain a fraction of the requested identities during the Core update; the affected identities attain the lowest ranks, and ranking identities by mean rank places all fourteen identities retained under a 2% violation among the top fifteen of 676. In contrast, the aggregate $\rho_U$ and calibrated attacks, evaluated on the same models, require a 5% violation to detect the leakage. The controls use a 90% deletion split and therefore characterize the sensitivity of the audit rather than the deployed operating point.

Experiments

Experimental Setup

Datasets. We evaluate on Market-1501 [53], VeRi-776 [30] and the cross modal RegDB [33], with 751, 576 and 206 identities, RegDB on the first of its ten standard splits. A random half is deleted and each survivor keeps $k=4$ images, leaving 1491 retained images against 6473 forgotten on Market-1501, 1152 against 18295 on VeRi-776 and 824 against 2060 on RegDB. The retain set is thinned on purpose. An erasure request does not compel it: deleting one person’s images says nothing about how much of everyone else’s a controller keeps, and it is a stress regime where retraining is weakest. The margin belongs to it: unthinned, in one run, the retrain is strong and Core only matches it, 82.5 against 82.2.

Metrics. Utility is scored using Rank-$k$ and mAP on the test set. Retrieval on the deleted identities is reported as $\mathcal{U}$ mAP, read against the retrained reference rather than as a quantity to drive down. Privacy is the ROC-AUC of three attacks on $U$, entropy-MIA [37, 39, 40], RMIA [52] and U-LiRA [4]. Each of them is read together with its true positive rate at a fixed low false positive rate. Non-members are test identities, whose classes the head does not contain, so each sample is scored against the model’s own prediction rather than a class it has no column for.

Implementation. We follow the TransReID [18] recipe on an ImageNet [9] pre-trained ViT-B/16 [10], with SGD on one NVIDIA RTX 5090: 120 epochs, 40 on VeRi-776, at batch 32 and a learning rate $8 \times10^{-3}$. Remaining hyperparameters are in the configuration files.

Comparison to Unlearning Baselines

We compare against Original without unlearning, Fine-tune [46] on $D_r$, gradient ascent GA [44] on $U$, Retrain from scratch on $D_r$, and nine recent unlearning methods. Neither Original nor Retrain provides a valid zero-leakage target, since Retrain still ranks another image of the deleted identities first in 90.3% of Market-1501 queries. We therefore report each method relative to the Retrain reference rather than relative to zero or Original.

Table 1 and Table 2 reveal two baseline behaviors: methods that retain retrieval performance for the deleted identities at approximately the Original level, and methods that approach Retrain by reducing it. Which behavior a method shows depends on the benchmark, not only on the method, and no method stays in the same group across all three. On Market-1501 every baseline falls into the first group, the lowest being LoTUS at 98.3 mAP on the deleted identities against 77.3 for Retrain. On VeRi-776 the same methods separate: SCRUB reaches 1.1 mAP on VeRi-776, below the 32.8 of Retrain, while on RegDB no baseline falls below the Retrain level at all.

Core reads at the Retrain reference on every attack. Over the three benchmarks, five deletion splits and three attacks the difference averages +0.006 and never exceeds 0.032, and on VeRi-776 it falls on both sides of zero. For scale, the methods that preserve retrieval on Market-1501 read between 0.98 and 0.99 on the same attack against 0.50 for the reference. Core achieves higher retrieval performance than the reference on all three datasets. The largest retrieval margin occurs on RegDB, where the thin retain set reduces standalone Retrain performance by 19.3 mAP. Enabling the Full branch restores the original retrieval performance, reaching 99.8 mAP on the deleted identities against Original’s 99.9. Figure 4 reads the same pairing off the embedding itself, as the mean distance of an image to its own identity center over the mean distance between identity centers, on all 376 deleted identities of Market-1501. A spread alone would not separate these cases, since the centers contract as well.

The results also expose two limitations of evaluating unlearning with a single privacy metric. SSD and LOFT have calibrated attack scores of 0.28 and 0.33 on Market-1501, far below the null, while retaining 99.4 and 99.6 mAP on the deleted identities. Thus, the attack statistic can indicate successful removal even when retrieval performance remains close to Original. AUC also averages the entire operating curve, so we additionally examine the low-FPR regime: at a 1% false-positive rate, RMIA recovers 1.0% of deleted images from Core and 1.2% from Retrain, compared with 78.4% from Original.

Two close numerical values do not establish equivalence, and confidence intervals should not be estimated by resampling images independently because images from the same identity share a subject and camera set. We therefore resample identities and evaluate Core against the variability among five independent retraining runs, with each run ranked against the other four. Ten of the twelve cells place Core within 1.5 standard deviations of the retraining distribution. The exception in the leakage direction is the true-positive rate on VeRi-776, where Core achieves 0.0156 compared with 0.0096 ± 0.0019 for the retraining distribution; we therefore do not claim equivalence for this cell.

Every competing method was designed for classification, so we reimplement all methods on a common ResNet-18 and evaluate class deletion at multiple scales on CIFAR-10, CIFAR-100 [25], and TinyImageNet. No single metric separates the methods in Table 3: gradient-ascent methods reach the null only by degrading the model, while SalUn falls below the retraining reference on the two smaller datasets. SCRUB is the exception, remaining near the reference at all three scales: on CIFAR-10 it achieves 0.24 versus 0.26 for Retrain, compared with 0.31 for Core, while Core matches Retrain within 0.004 on the other two datasets.

Method	CIFAR-10 retain	CIFAR-10 $U$	CIFAR-10 MIA	CIFAR-100 retain	CIFAR-100 $U$	CIFAR-100 MIA	TinyImageNet retain	TinyImageNet $U$	TinyImageNet MIA
Original	94.2	100.0	0.44	76.4	100.0	0.68	65.0	99.9	0.70
Fine-tune	94.3	79.3	0.07	77.4	91.3	0.32	65.4	8.0	0.20
GA	11.1	0.0	0.50	1.1	0.0	0.50	0.6	0.0	0.50
NegGrad+	12.7	0.0	0.50	2.5	0.0	0.53	0.6	0.0	0.47
SalUn	94.4	10.0	0.01	76.6	63.8	0.07	65.0	95.6	0.44
Bad Teacher	92.1	0.2	0.03	70.1	1.2	0.08	59.5	74.4	0.36
SCRUB	93.8	0.0	0.24	76.9	0.0	0.28	65.0	0.0	0.20
Retrain	94.3	0.0	0.26	77.7	0.0	0.26	65.3	0.0	0.22
MoME-Core	94.1	0.0	0.31	77.3	0.0	0.24	65.3	0.0	0.22

Attack AUC measures whether samples are distinguishable, whereas $\rho_U$ in Eq. (4) measures whether a model behaves like retraining under the requested deletion. We therefore report $\rho_U$ only for Core and use the attacks for cross-method comparison. Core achieves 0.538, 0.487, and 0.494, all within the range of their matched retraining families. Although the family mean is always $\frac{1}{2}$ by construction, its spread provides the relevant reference. The audit controls confirm sensitivity: when the model retains $U$, the readout falls to the bottom of the rank scale. This remains detectable for a small request: restricting the audit to five of 376 deleted identities keeps the leaking readout at the floor, while the calibrated attacks no longer resolve a 0.3 signal.

Ablation Study

All ablations use Market-1501 on the deployed deletion split at seed 42 and 100 epochs, which is why the rows sit below Table 1, and the Step 2 control is repeated on RegDB; component ablations are in Table 5.

Variant	Core mAP	Full mAP	MIA$_{\mathrm{ent}}$
w/o Gradient Isolation	85.1	88.3	0.995
w/o Step 2	74.3	74.3	0.491
Frozen backbone	2.4	73.7	0.506
Parasitic $\gamma$ only	75.4	78.1	0.487
Parasitic $\beta$ only	75.4	77.8	0.487
Ours $\gamma+\beta$ co-trained	74.4	81.5	0.493

Gradient isolation. Removing gradient isolation raises Core to 85.1 mAP, close to the 88.0 of a model that never unlearned, and the attack reads 0.995: without isolation the core trains on $D_f$ too, so it does not forget. The pair still reaches 88.3 in Full, so the row does not fail for want of capacity. It fails because the capacity sits in the core rather than in the branch, which is the one arrangement the switch cannot undo. Isolation costs 10.7 mAP of Core and is what moves the attack to the null.

Step 2. Removing it leaves Core where it was: the Core-only row of Table 1 and Table 2 sits within 1.0 of Core on every retrieval column and within 0.011 on every attack column. Nor does it cost Full: consolidating from that core reaches 88.7 mAP, the same as from the co-trained one. The payload needs a core, not a second step, and the 3.8 mAP over a plain retrain comes from how Step 1 trains on $D_r$. What Step 2 buys is the co-trained branch rather than the core or the payload: without it the shadows stay at their zero initialization, so Full equals Core at 74.3, where co-training carries Full to 81.5.

A frozen backbone. Freezing it collapses Core to 2.4 while Full still reads 73.7. Step 1 then has nothing to adapt, so the core is the pre-trained initialization with heads on top and the 73.7 is the branch carrying $\mathcal{U}$ on features it did not shape. The attack still reads 0.506, so safety does not rest on the core being any good: the core never sees $D_f$ whether or not it can learn from what it does see. What the row gives up is utility, and that is the part Step 1 takes from $D_r$.

One shadow or both. A scale shadow alone and a shift shadow alone leave the same core, because Step 2 cannot reach it and Core mode excludes the branch, so both read 75.4 mAP of Core and the two rows differ only in Full, at 78.1 and 77.8. Which affine the branch is given therefore does not matter; how much of one it is given does. Neither reaches the capacity of the pair: co-training raises Full to 81.5 for 1.0 mAP of Core. All three sit at the null, so capacity is set by the parasitic budget and safety by whether the core ever sees $D_f$.

Generality across foundation model backbones

MoME needs only affine LayerNorm or BatchNorm parameters, so the mechanism should transfer beyond the ImageNet pre-trained ViT. We repeat the comparison on a ResNet-50 AGW backbone, on CLIP-ReID [29, 36] and on a ResNet-18 trained from scratch for CIFAR-10 class deletion, each against a reference retrained on its own $D_r$. Table 4 reads the four settings. Core matches or beats that reference on utility, and its Forgetting-Rank sits at the null inside the band the reference family spans. On the two non-ViT backbones that band is too wide to resolve anything, so what transfers there is the retrieval advantage and the mechanism running, not a privacy result. A BatchNorm backbone needs its running statistics frozen in Step 2, and these runs did not freeze them. The switch does not transfer as widely: on ResNet-50 and CLIP the payload no longer restores the deleted identities, and on CIFAR-10 it carries their loss profile at chance accuracy, so Full remains a result for the pre-trained ViT.

Backbone	Norm	Pretrain	Task	Utility Core	Utility Retr.	Privacy, $\rho_U$ Core	Privacy, $\rho_U$ Retr.	Privacy, $\rho_U$ Full
ViT-B/16	LN	ImageNet	ReID, Mkt	74.2	70.5	0.500 ± .023	0.500 ± .085	0.100 ± .000
ResNet-50 AGW	BN	ImageNet	ReID, Mkt	47.5	33.3	0.500 ± .254	0.500 ± .241	0.880 ± .015
CLIP ViT-B/16	LN	contrastive	ReID, Mkt	77.7	67.6	0.500 ± .128	0.500 ± .232	0.896 ± .005
ResNet-18	BN	scratch	CIFAR-10	47.8	47.8	0.502 ± .056	0.501 ± .050	0.152 ± .005

Conclusion

We present MoME, a switchable framework for unlearning by design that can be adapted to existing backbones. We additionally introduce Forgetting-Rank, a statistic that tests whether the loss on forgotten samples is statistically indistinguishable from that of models trained without them. MoME separates a backbone into core parameters, which preserve retrieval, and parasitic parameters, which isolate forget-set knowledge. Under gradient isolation, the Core is provably independent of the forget set up to paths outside the gradient, while Forgetting-Rank provides a rank-based audit for trained models. Across Market-1501, VeRi-776, and RegDB, the deployed Core reads at the retrained reference on every attack while achieving higher retrieval performance, on ResNet and CLIP backbones as well.

Acknowledgements. This research was partially supported in part by South Dakota State University’s High Performance Computing resources.

Gradient Isolation Yields Exact Unlearning

We now show that the two step schedule of § 2.3 is not merely a heuristic: it renders the deployed Core parameters provably independent of the forgotten data, up to a small enumerable set of coupling channels that we state and audit. The induction below is short, and its content is in the assumption set: withholding forget-set gradients from the core is not the same as making it independent of the forget set, since data reaches parameters by paths outside the gradient. Two such paths exist in this implementation, the Batch Normalization buffers in the classification heads and the decision of whether to apply an update, and the second had to be changed in the code before A5 held of it.

Setup and notation

Let $\theta= (\theta_c,\theta_p)$ collect the core and parasitic parameters, and let $b$ denote all state that is not updated by gradients, for example the BatchNorm running statistics in the heads. Training uses the full set $D_f$, the retain set $D_r \subseteq D_f$ the core is updated on, and the forget set $\mathcal{U} \subseteq D_f$ named by the request, with $\mathcal{U} \cap D_r = \emptyset$. Everything below uses that disjointness alone. Under the deployed protocol the retain side is thinned, so $D_f \setminus D_r$ is strictly larger than $\mathcal{U}$: it also holds images of retained identities that $D_r$ did not keep, which no request covers and which the membership results treat as a separate population. A single iteration $t$ performs two forward and backward passes and one optimizer step:

• Step 1, Core. With $\theta_p$ excluded from the forward pass in Core mode and requires_grad($\theta_p$)=FALSE, draw a batch $B_r^t \subseteq D_r$ and form $g_c^t = \nabla_{\theta_c}\mathcal{L}(B_r^t;\theta_c^t)$.

• Step 2, Full. With requires_grad($\theta_c$)=FALSE, draw $B_f^t \subseteq D_f$ and form $g_p^t = \nabla_{\theta_p}\mathcal{L}(B_f^t;\theta_c^t,\theta_p^t)$.

• Update. $\theta_c^{t+1} = \mathcal{U}_c(\theta_c^t,g_c^t,m_c^t)$ and $\theta_p^{t+1} = \mathcal{U}_p(\theta_p^t,g_p^t,m_p^t)$, with disjoint optimizer states $m_c,m_p$.

Write $\omega_r$ for all randomness in Step 1, namely retain batch order, augmentation, and dropout masks. Step 1 also reads a fixed ensemble of teachers, each trained on $D_r$ alone, which enter as inputs derived from $D_r$.

Such a $\phi$ is distributed exactly as the same procedure run with Step 2 removed, which is a training run that never reads $\mathcal{U}$. It is not thereby distributed as an arbitrary retain-only algorithm. Two procedures can both ignore $\mathcal{U}$ and still produce different parameters, different losses and different attack scores, so agreement with a particular retrained baseline is an empirical claim about that baseline and does not follow from this definition. The guarantee is also relative to the training run it describes: it says nothing about information about $\mathcal{U}$ that the initialization already carries, which for an ImageNet or CLIP backbone is not something this procedure can remove.

We make explicit the assumptions under which isolation is exact; each names a coupling channel that our audit of eleven channels tests in practice.

Assumption 1.

A1 Purity of the Core forward. The Core forward excludes $\theta_p$; hence $g_c^t$ is independent of $\theta_p$.

A2 Core freeze in Step 2. requires_grad($\theta_c$)=FALSE in Step 2, so autograd contributes 0 to the core gradient there.

A3 No stateful leakage. Backbone normalization is LayerNorm, which is per-sample and keeps no running buffers. The only buffered norms are the head BN-Neck, whose affine terms belong to $\theta_c$ while their running statistics are buffers. Those buffers carry no gradient, and the training forward runs in train mode, where BatchNorm normalizes by the statistics of the batch in hand rather than by the running estimates, so no core gradient is a function of them whether or not Step 2 updates them. Freezing them in Step 2 keeps the buffers themselves free of $D_f$ as well, which matters for the classifier logits and not for $\theta_c$.

A4 Step 1 randomness from the retain set. $\omega_r$, comprising sampling, augmentation, and dropout, is drawn over $D_r$. The two steps share one pseudo-random stream, so $\omega_r$ can depend on how many forget batches have been drawn, a count the set sizes fix, and on no sample of $\mathcal{U}$.

A5 Disjoint optimizer state and update decision. $m_c$ and $m_p$ are maintained per-parameter and never shared, and whether an update is applied is decided separately for the two groups. A decision taken jointly would be a channel rather than a count, since whether a batch produces a non-finite gradient depends on that batch; a non-finite Step 2 gradient must therefore drop $g_p^t$ alone and leave $g_c^t$ applied. Mixed-precision loss scaling is one such shared decision and is disabled under the bfloat16 autocast these runs use.

Proof. By induction on $t$. Base. $(\theta_c^0,m_c^0)$ is the ImageNet initialization, independent of all training data. Inductive step. Assume $(\theta_c^t,m_c^t)$ depends only on $(\theta^0,D_r,\omega_r)$. In Step 1, A1 gives $g_c^t=\nabla_{\theta_c}\mathcal{L}(B_r^t;\theta^t)$ with $B_r^t\subseteq D_r$ selected by $\omega_r$ under A4; thus $g_c^t$ is a function of $(\theta_c^t,D_r,\omega_r)$. In Step 2, A2 sets the core gradient to 0, so Step 2 alters neither $\theta_c$ nor $m_c$. It may update the head Batch Normalization buffers, which are left free in the runs reported here, but A3 puts those outside the induction: the training forward normalizes by the batch in hand, so no core gradient is a function of them. The update $U_c$ therefore combines only quantities that are local to the core and free of $U$, as ensured by A5, and $(\theta_c^{t+1},m_c^{t+1})$ remains a function of $(\theta^0,D_r,\omega_r)$. The forget set $U$ enters the computation only through $B_f^t$ in Step 2, which updates $\theta_p$ and, where the freeze is off, the head buffers, neither of which the induction carries. The claim follows for all $t\leq T$. □

Remark 1 (Privacy parity, and why Core can exceed the reference). Step 2 leaves the core unchanged, so the Core trajectory coincides with the same procedure run with Step 2 removed, a run that reads $D_r$ alone: Core is a bona fide estimator trained on $D_r$, and its membership advantage on $U$ is that of a procedure that never read $U$. Whether it also matches the particular retrained baseline reported in the tables is measured there and is not implied here. Any separability that remains, visible as Core sitting at the reference’s leak level in Figure 1, is generalization from $D_r$ rather than memorization of $U$. The same proposition forbids any trace of $U$ in $\theta_c$ at the gradient level, so Core’s utility edge over the reference cannot come from leaked information either. It reflects optimization differences on the retain side, distillation from an ensemble retrained on $D_r$ alone and the pacing of the core’s passes over it, and disabling Step 2 leaves Core unchanged, so it is not a co-training effect. The proposition pins privacy by construction while leaving utility unconstrained.

Remark 2 (Scope). Prop. 1 is an exact statement at the parameter level, unlike approximate or certified unlearning, but conditional on Assumption 1. It confers no differential privacy with respect to $D_r$, which Core legitimately learns, and says nothing about the Full model, which encodes $U$ in $\theta_p$ by design. The audit of eleven coupling channels and three membership attacks, read at low false positive rates, exists to test A3 and A5 in practice.

A calibrated test for residual memorization

Prop. 1 makes forgetting testable, and Sec. 3.4 introduced the instrument: reference-based attacks confound Core’s superior generalization with leakage, cf. Remark 1, so $\rho_U$ of (4) instead ranks each forgotten sample’s cross-entropy among shadow models trained by the same procedure, using only the shadows $S(x)$ whose retain set excludes $x$. Write $r(x)$ for the inner normalized rank in (4), so that $\rho_U$ is its average over $U$. Here we prove that this calibration is exact.

Proof sketch. By Prop. 1 the target core parameters are a deterministic function of $(\theta^0,D_r,\omega_r)$ and independent of $U$; for $x\in U$ this holds for the target and for each shadow $j\in S(x)$, all of which excluded $x$ from their retain set. On the retrieval benchmarks they share one retain set and differ only in training randomness, an i.i.d. draw; on the classification benchmark the retain sets are i.i.d. draws as well. Either way the induced scores $\ell(x;\cdot)$ are i.i.d. conditional on what the family shares, and thus exchangeable; the rank of one exchangeable variable among $m$ is uniform, giving $\mathbb{E}[r(x)]=\frac{1}{2}$. Averaging and the exactness of rank tests under exchangeability yield the claim. □

Two properties make $\rho_U$ the right instrument. It is unconfounded: the target and its calibrating shadows share architecture, objective and optimizer, so any effect of generalization or optimization quality shifts their scores together and cancels in the rank; only genuine training on $x$, which Prop. 1 forbids for Core, can bias $r(x)$ downward. It is powerful: reading the same network in Full mode, whose parasitic branch was trained on $U$, drives $\rho_U$ from 0.500 to 0.100, the floor of the statistic at five calibrating shadows, so on almost every forgotten sample the leaking readout is the most confident model in the comparison. Taking the identity as the unit, which the images of one person require, every one of the 1880 identity readings falls below the null and 1877 sit at the floor. We calibrate against the reference family’s measured spread rather than against the analytic null, because the scores are only approximately exchangeable: that family’s own spread across targets is 0.085 on Market-1501, 5.8× what exchangeability predicts with the identity as the unit, since training randomness varies the models more than the assumption allows. Read against that spread the test resolves a move of about 0.17, two of its standard deviations, and the leaking readout moves $\rho_U$ by 0.40.

Additional Experiments and Analyses

Reading the tables in this appendix. Six conventions govern the numbers below. First, the Forgetting-Rank $\rho_U$ is deconfounded and ideal at exactly $\frac{1}{2}$, so for a single model ranked against shadows that never trained on the sample its quality is the distance $\lvert\rho_U-\frac{1}{2}\rvert$, with a value below $\frac{1}{2}$ indicating residual memory of the forget set and a value above it indicating over-forgetting. A family average is a different object, $\frac{1}{2}$ by a counting identity whatever its members did, so where a table reports one it is the spread that carries the information and not the distance from $\frac{1}{2}$. Second, the calibrated attacks RMIA and U-LiRA are judged against a genuine retrain rather than against an absolute target: this is the retrained reference row, which sits near $\frac{1}{2}$ in the re-identification tables once the loss-based attacks score each sample against the model’s own prediction. The uncalibrated entropy-MIA is read the same way, against the reference in its own table rather than against a fixed number, since its scale depends on how far the query non-member sits from the training distribution. Third, privacy and utility are read together: a low attack score certifies forgetting only when accuracy or mAP is preserved, whereas the same score reached while utility collapses, as for NegGrad+ and GA, is over-forgetting rather than removal. Utility is always read against the reference named in each caption. Fourth, every calibrated attack in this appendix is scored against a reference family that contains no checkpoint the core was distilled from and is not the row being evaluated, so no model is asked whether it is distinguishable from a population it was trained to imitate. Fifth, on RegDB the retrained reference uses AdamW rather than the SGD schedule the ViT uses on the other two datasets, which does not train at all on the 824 retained images; the baselines there are searched over their own rates for the same reason, so that no row reports a recipe failure as a method result. Sixth, wherever the parasitic branch is read as a target, it is ranked against the other four seeds’ cores and not against all five. The target is one of the family’s own members read a second way, so including its own core would compare it with itself; leaving it out puts the floor of the scale at $\frac{1}{10}$ rather than $\frac{1}{12}$, which is why the payload readings bottom out at 0.100.

Training configuration

The body gives the recipe; the remaining settings are here so the runs can be rebuilt without the code. The backbone is ViT-B/16 pre-trained on ImageNet, following Tran-SreID including random erasing [54]. Training uses SGD at $8 \times10^{-3}$ under a cosine schedule with a parasitic learning rate multiplier of 5 and batch 32 on one NVIDIA RTX 5090, for 120 epochs on Market-1501 and RegDB and 40 on VeRi-776, in each case ending near the point where the core stops improving. Step-1 distillation uses a feature-space objective against retain-only teachers, four of them on Market-1501, three on VeRi-776 and five on RegDB, weighted 0.15 on Market-1501 and RegDB and 0.45 on VeRi-776. Step 1 takes one core update per iteration on Market-1501 and RegDB and one every fourth on VeRi-776, the period chosen so the core makes a comparable number of passes over its retain set each epoch: 372 steps over 47 retain batches is 7.9 on Market-1501, 1154 over 36 at a period of four is 8.0 on VeRi-776, and 129 over 26 is 5.0 on RegDB. A standalone retrain makes one pass per epoch. Those extra passes are not extra fitting on Market-1501, where the reference already reaches 99.8 mAP on its own retain set, and they are on VeRi-776, where it reaches 52.7. Both steps clip the gradient norm at 5 and clamp every parasitic parameter to $[-5,5]$. The Core-only control is the deployed configuration with MOME.CORE_ONLY set, which disables Step 2 and changes nothing else: the two resolved configurations agree on every key that both record. Across the five seeds the Market-1501 core holds 74.2 mAP with a spread of 0.17 and the retrained reference 70.5 with 0.82, so the 3.7 between them is more than four times the wider of the two. Running the consolidation stage on that Core-only core, with the same original and the same schedule the deployed payload uses, reaches 88.73 mAP against the deployed payload’s 88.7 and leaves the Core it was built from untouched at 74.21. The two payloads also read alike under attack, 0.9977, 0.9406 and 0.8474 against 0.9978, 0.9419 and 0.8511, so the branch that ships does not depend on Step 2 having run. The substitution is not free everywhere: on RegDB it reaches 65.7 against the deployed payload’s 66.6, again leaving its Core untouched at 55.2. The equality is a Market result and what holds on both is that nearly all of the payload survives being built from a core that never co-trained. Consolidation adds 30 epochs at $4 \times10^{-3}$ with label smoothing off, matching the objective that produced the original model. BatchNorm running statistics are left free during Step 2 in every run reported here. On the LayerNorm backbone that is safe and measured; on the BatchNorm ones it leaves the path open. On RegDB the retrained reference and the ensemble that teaches the core use AdamW [31] at $3 \times10^{-4}$, since the SGD schedule used elsewhere does not train at all on the 824 retained images. The core itself trains under the SGD schedule at $8 \times10^{-3}$ like the other two benchmarks. The baselines there run their own rates under the same rule: $5 \times10^{-4}$ to $8 \times10^{-4}$ for NegGrad+, SalUn, Bad Teacher and SCRUB, AdamW at $3 \times10^{-4}$ for Fine-tune, which retained more utility there, 54.8 mAP from visible to thermal against 5.2 under the shared schedule, and the shared rate for GA, which survives it. SSD takes no gradient step, and LoTUS and MUNBa carry their authors’ rates.

Every baseline starts from the same standard checkpoint, sees the same retain set and the same deletion request, and runs its published objective inside the TransReID data pipeline, with its own hyperparameters at the values its authors report. The weights say so rather than the scripts: every baseline checkpoint sits closer to that standard checkpoint than to the ImageNet initialization, with one exception, the dampening method on RegDB, which sits 0.174 from the one against 0.171 from the other. That method moves furthest of the baselines on Market-1501 and still leaves 145 of the 211 core tensors bitwise identical to the checkpoint. Two rows are exceptions. LOFT is a projection of the embedding and leaves the weights untouched, and the LoRA row is ours rather than a port: low-rank adapters on the MLP projections of every block, backbone frozen, fitted to $D_r$, following the low-rank adapter line of [6], which targets language models and has no re-identification counterpart to port. One row is worth reading across splits rather than down a column: on RegDB, LoRA reproduces the original model to two decimals on the deployed split and moves well away from it on the other four, from 42.5 to 51.1 against the original’s 64.7. The deployed run is not a no-op either. It moves 66 backbone tensors, the projections it adapts, by $2.3 \times10^{-3}$ in relative norm, which is below what any column here resolves, where the other four move three times as far. How far the adapter travels depends on which identities it is asked to forget, which is why the spread on that row is the widest in the table. Methods that take their learning rate from the shared schedule are given a search over three rates where that schedule destroys the model, $10^{-3}$ down to $10^{-4}$ for SCRUB and the shared $8 \times10^{-3}$ down to $5 \times10^{-4}$ for NegGrad+, since the from-scratch rate is not meant for a converged ReID network. On Market-1501 that is SCRUB and NegGrad+, and they are the two the sweep covers; Fine-tune, GA, SalUn and Bad Teacher keep the shared rate, which they survive. LoTUS at $10^{-5}$, MUNBa and LOFT carry their own rates from their papers and run at those, and SSD dampens weights without a gradient step. The main table reports the configuration that keeps the most utility, on the principle that a method which has destroyed the model cannot be said to have unlearned, and Table 6 gives the sweep. Both swept methods trace the same curve. NegGrad+ reaches the retrained reference on the attacks only at the rate that costs most of the retrieval, 28.2 mAP against the reference’s 70.5, and SCRUB does not reach it at any rate we tried; both keep retrieval only where the attacks rise to the level of a model that never unlearned. Neither end is the frontier, and the two ends belong to one method rather than to two, which is the same split the main comparison reports across methods.

Method	Rate	test mAP	$\mathcal{U}$ mAP	RMIA
SCRUB	$10^{-3}$	31.3	45.6	0.560
	$5 \times10^{-4}$	43.9	65.2	0.709
	$10^{-4}$	85.4	99.7	0.987
NegGrad+	$8 \times10^{-3}$	28.2	31.7	0.494
	$10^{-3}$	86.2	99.7	0.990
	$5 \times10^{-4}$	86.4	99.7	0.990
Retrain		70.5	77.3	0.511
MOME-Core		74.3	80.1	0.511

Definitions of the reported privacy columns

Let $\theta$ be the model under audit, $f(x;\theta) \in\mathbb{R}^{d}$ the embedding it retrieves with, and $p(x;\theta) \in\Delta^{C-1}$ the softmax of its identity head over the $C$ training identities. $\mathcal{U}$ is the forget set and $\mathcal{Q}$ the non-member pool, the test query split. The references $\theta^{(1)},\ldots,\theta^{(K)}$ are retrains of the same retain set under different optimization seeds, none of which sees $\mathcal{U}$.

Two per-sample losses appear below. The true-label loss $\ell(x,y;\theta)=-\log p_y(x;\theta)$, which is the statistic the loss-threshold attack scores [51], is defined only where the identity has a column in the head, which excludes $\mathcal{Q}$. The loss-based columns therefore use the label-free

the cross-entropy of $x$ against the model’s own prediction, which is the same quantity on both pools. Every attack column is the area under the ROC curve of a score $s$ that is meant to be larger on members,

$\mathcal{U}$ mAP. Retrieval is run inside $\mathcal{U}$, each image once as a query and once as a gallery entry. For a query $x$ the gallery is $G(x)=\{x'\in\mathcal{U}:x'\ne x,\neg(\operatorname{id}(x')=\operatorname{id}(x)\land\operatorname{cam}(x')=\operatorname{cam}(x))\}$, ranked by cosine distance $1-\hat{f}(x)^{\top}\hat{f}(x')$ on $\hat{f}=f/\lVert f\rVert_2$, equivalently the Euclidean distance on $\hat{f}$, which the implementation uses. With $r_x(k)=1$ when the $k$-th ranked entry shares the identity of $x$ and $R_x=\sum_k r_x(k)$,

MIA$^{\mathrm{ent}}$. The uncalibrated entropy attack, one of the families surveyed in [21], scores confidence directly, with no references,

RMIA. The target’s loss is compared against the loss the reference population assigns to the same sample,

U-LiRA. The offline variant standardizes the same difference by the spread of the reference population. With $\mu(x)$ and $\sigma(x)$ the mean and standard deviation of $\{\widetilde{\ell}(x;\theta^{(k)})\}_{k=1}^{K}$ and $\epsilon=10^{-6}$,

Choice of the label-free loss. The choice is forced rather than preferred, and the size of the artifact says why. Scoring $Q$ against a fixed dummy column instead, so that the true-label loss is defined everywhere, moves the calibrated columns further than the quantity they are meant to resolve and moves them differently on each benchmark. On Market-1501 it puts Core at 0.467 RMIA and the retrained reference at 0.446, both below the null. On RegDB it puts Core at 0.976 against the reference’s 0.471. A statistic that reads 0.47 on a model retrained without $\mathcal{U}$ is not measuring membership, it is measuring where the deleted identities’ head columns used to be, and the substitution moves the reference as far as it moves Core. Under Eq. (5) the two sit within 0.016 of each other on all three benchmarks.

reference as far as it moves Core. Under Eq. (5) the two sit within 0.016 of each other on all three benchmarks.

Adaptation and power of the two calibrated attacks. Eq. (9) and Eq. (10) are adapted forms, and we name them after the attacks they follow rather than claim to reimplement them. RMIA in its original form is a pairwise likelihood ratio between the target and the reference models, calibrated over a population of reference samples; the form here keeps the reference calibration but reduces the comparison to the difference between the target loss and the reference mean. The offline LiRA fits the reference population and reports a tail probability; the $z$ score of Eq. (10) is monotone in that probability under the same Gaussian, so it induces the same ordering, but the per-sample statistic is the label-free loss of Eq. (5) rather than a logit-scaled true-label confidence, because the non-member pool has no column in the head. The adaptations retain their power on this task, which is the property that matters here: against the same references, a model that did train on $\mathcal{U}$ is separated from a retrain at up to 0.38 true positives for 1% false positives against the reference’s 0.012, and the consolidated payload is detected on all three benchmarks. An attack weakened into uninformativeness would not do that.

The payload against the original model. Consolidation initializes the branch at the difference toward the original and refines it, which invites the reading that Full is the original recovered by arithmetic and that the pair is therefore two copies of models that already exist. It is not. Measured over the 206 tensors the two checkpoints share, the payload sits 0.071 from the original in relative parameter norm where Core sits 0.099, and 66% of the payload’s displacement from Core is orthogonal to the direction of the original, so refinement moves it off that line rather than along it. Functionally it reaches full-data accuracy by a different route: 88.7 mAP on Market-1501, above the 88.0 of the Original row, from a point that is not on the line toward the model it was initialized from. The stage leaves Core alone. Of the 193 core-side tensors the two files share, 188 are bitwise identical, including all ten Batch Normalization running estimates. The five that differ are the BNNeck batch counters, which advance because the stage runs forward passes and which evaluation does not read. What a pair of separately trained files does not have, whatever it stores, is any statement tying the deletion to a property of the parameters that ship. Core carries one and a retain-only student trained by some other procedure does not.

Resolution of an attack AUC on these benchmarks. Two numbers being close is not an equivalence test, and an interval computed over images is not the right interval, since images of one identity share a subject, a camera set and a difficulty. Every interval here resamples identities. Market-1501 offers 1126 identity clusters across the two pools, VeRi-776 488 and RegDB 309, and that difference decides what each benchmark can say.

Tab. 7 says three things. The interval half-width near the null averages 0.022 on Market-1501 and 0.024 on VeRi-776, whose smaller identity count is offset by a member pool of 18295, and 0.045 on RegDB, so a difference below roughly 0.04, 0.05 and 0.09 is not resolved by these pools at all, whatever the point estimates look like. On Market every Core row and the Core-only control differ from the retrained reference by at most 0.005 with an interval that contains zero, while the consolidated payload differs by 0.431 with an interval far from it, so the instrument separates what it should and does not separate Core from a retrain. On RegDB one of the five seeds, 123, excludes zero at the 90% level before any allowance for having tested five; a second, 789, has an interval whose lower end sits on zero at −0.0004, and the other three contain it comfortably. That last reading is against one retrain, and one retrain is itself a draw. Ranking each member of the disjoint family against the other four gives what retrains span among themselves: on RegDB 0.5016±.0323 on RMIA, from 0.4684 to 0.5499, against Core’s five seeds at 0.5475±.0180, from 0.5262 to 0.5689. Core’s mean sits 1.43 of those standard deviations above the family’s and the two ranges overlap over most of their length, with one family member at 0.5499 reading higher than two of the five Core seeds. The same comparison on Market-1501 puts Core 0.73 standard deviations above the family on RMIA and 1.66 below it on the true positive rate. So the separation a single reference showed is that reference being one draw from a spread of 0.032, not Core being distinguishable from retraining, and the honest statement is that Core sits inside the band on both benchmarks and above its centre on each, by 0.73 standard deviations on Market-1501 and 1.43 on RegDB.

Targets and references under different preprocessing.

Two rows on VeRi-776 need care, the original model and the LOFT projection applied to it. The original was trained with a pixel normalization of 0.5 in every channel while the retrained references use the ImageNet statistics, and an attack that pushes every model through one dataloader cannot serve both: under the target’s pipeline the references are out of distribution, and under the references’ pipeline the target retrieves at 36.5 mAP instead of 82.4. The attack compares each model’s own loss on a sample, and an adversary holding these models would run each one as it was trained, so the reference pass is given its own preprocessing. The two passes keep the sample order fixed, so they align by index. It decides five cells across those two rows. Read through one pipeline the original model appears to leak at 0.60 on the entropy attack, and read correctly it leaks at 1.00, which is where a model that trained on every deleted identity belongs.

The control for the per-model pass is a second original trained from scratch on the same recipe with only the normalization changed, so that target and references share one input space and no per-model pass is needed. It retrieves at 97.0 Rank-1 and 79.6 mAP against the released original’s 97.1 and 82.3, and against the same four references it reads 0.99, 0.92 and 0.83 on the three attacks, with 0.24 true positives at 1% false positives. The row the table prints reads 1.00, 0.91 and 0.82, with 0.25. The two differ by at most 0.018 on the three attacks and by 0.012 on the true positive rate, while the single-pipeline reading of 0.60, 0.59 and 0.58 agrees with neither. The per-model pass recovers what a natively matched model shows.

The reference population against the distillation teachers. Step 1 distills from an ensemble of retrains on $\mathcal{D}_r$, and the calibrated attacks score a target against a population of retrains on the same $\mathcal{D}_r$. In the runs behind Table 1 those two sets were the same four checkpoints, which makes the comparison circular: a model trained to imitate a population is then asked whether it is distinguishable from it. To remove the overlap we trained four more retrains on the identical deletion split, none of which appears in any teacher list and none of which is the evaluated retrained row, and rescored every Market-1501 row against them.

Tab. 8 gives the result. The objection predicts that removing the teachers from the reference population should push Core away from the null and expose a leak the overlap had hidden. U-LiRA moves by 0.010 and 0.012 on the two Core rows, landing at 0.513 and 0.510 against the retrained reference’s 0.511; RMIA moves by a single unit in the last place on both. Entropy reproduces to four decimals, which fixes the pipeline rather than the references. The overlap was not carrying the result.

Row	ent	teacher refs RMIA	teacher refs U-LiRA	disjoint refs RMIA	disjoint refs U-LiRA
Original	0.999	0.991	0.979	0.991	0.979
Fine-tune	0.982	0.984	0.975	0.984	0.974
Retrain	0.493	0.511	0.514	0.511	0.511
Core-only	0.491	–	–	0.511	0.515
Core s42	0.492	0.510	0.503	0.511	0.513
Core s123	0.490	0.504	0.498	0.505	0.510

The rescoring covers all three benchmarks and every attack cell that carried a reading under the teacher references. Of the 132 such cells outside the VeRi-776 original, whose preprocessing is a separate question, thirty-eight change at the precision the tables print, twenty-nine by a single unit in the last place, and none by more than 0.03. The largest move is the retrained reference on RegDB, from 0.48 to 0.51, and it is a correction: the old comparison ranked that reference inside its own family, which pulls a member slightly below the null, while against an independent family it sits on the null, where a reference belongs. Core on RegDB follows it from 0.50 to 0.53, so the gap between the two rows is what it was. No conclusion in the paper turns on any of these moves.

The disjoint family also supplies its own band. Training a fifth member on each benchmark and ranking each of the five against the other four gives the spread a genuine retrain has against its own kind, and Core’s five seeds are read against it in Table 9.

Statistic	Retrain band	MoME-Core	distance
Market MIA$_{\mathrm{ent}}$	.4866±.0032	.4914±.0015	+1.5
Market RMIA	.5000±.0132	.5096±.0033	+0.7
Market U-LiRA	.4998±.0131	.5135±.0021	+1.0
Market TPR@1%	.0112±.0014	.0090±.0009	−1.7
VeRi MIA$_{\mathrm{ent}}$	.5110±.0072	.5195±.0043	+1.2
VeRi RMIA	.4994±.0141	.5078±.0076	+0.6
VeRi U-LiRA	.4995±.0141	.5058±.0090	+0.4
VeRi TPR@1%	.0096±.0019	.0156±.0021	+3.1
RegDB MIA$_{\mathrm{ent}}$	.5187±.0204	.5402±.0150	+1.1
RegDB RMIA	.5016±.0323	.5475±.0180	+1.4
RegDB U-LiRA	.5002±.0321	.5383±.0169	+1.2
RegDB TPR@1%	.0117±.0067	.0177±.0059	+0.9

Ten of the twelve cells place Core within 1.5 standard deviations of the band. Of the two that do not, the Market-1501 low false positive column sits 1.7 below it, which is the over-forgetting direction and not a leak. The one that matters is the same column on VeRi-776, where Core reads .0156 against the band’s .0096±.0019, a distance of 3.1. In counts that is about 285 of the 18295 members recovered at 1% false positives against the band’s 176, so roughly a hundred more, and we do not claim Core is indistinguishable from a retrain at that operating point on that benchmark. Core’s own spread is tighter than the family’s everywhere, four times so on Market-1501 RMIA, .0033 against .0132, which is what a fixed retain set and a fixed teacher ensemble buy over training from scratch five times. What this establishes is that the particular checkpoints did not matter, since the new references are themselves retrains on the same retain set. It does not establish that distilling from retrained teachers is neutral in general, and the cost of that ensemble, four training runs, is stated where the method is described.

Contribution of the retain-side recipe. The lift over a plain retrain separates into the two parts the method claims for it. Trained at seed 42 with the arms differing only in the teacher list, Core reads 73.16 mAP under the Step-1 pacing with no distillation, 74.36 with one retain-only teacher and 74.89 with four, against 70.5 for a retrain on the same split. The pacing carries 2.7 of the 4.4 point gap, the first teacher 1.2 and the three after it 0.5. Read the last step with the drift between runs in mind: the four-teacher arm is the deployed configuration retrained alongside the others and it gives 74.89 where the deployed run reads 74.34, so half a point separates two runs of one configuration and this series resolves only the first two steps.

The payload readout across backbones. Full reads the same weights as Core with the parasitic branch on. That readout did train on $\mathcal{U}$, so it is not exchangeable with the retain-only family, and on every backbone all five of its readings fall outside the range the reference family spans, which is the strongest separation an exact rank test on five against five can show, $p=0.008$. Its direction follows how the branch fails and is not itself a privacy quantity.

Omission of the representation-level probe. A linear probe on hidden features is a standard membership attack

and we ran it, then removed it from the tables because it does not measure membership under this protocol. Let $h(x) \in\mathbb{R}^{d}$ be the class token at block 10 of the frozen backbone and fit $s_{\mathrm{LP}}(x) = \sigma(w^{\top}h(x) + b)$ to separate $\mathcal{U}$ from $\mathcal{Q}$. Two facts sink it.

First, the folds have to be grouped by identity. The two pools hold different identities and every identity contributes several images, so folds split by image place one identity on both sides and let the probe score by telling identities apart. Grouping drops the Market-1501 column, over the unlearning rows and the reference, from a range of 0.78 to 0.92 to one of 0.63 to 0.72.

Second, what survives fails a positive control. The consolidated payload encodes $\mathcal{U}$ by construction and every other attack detects it, entropy at 1.00 and RMIA at 0.94 on Market-1501. The probe reads it at 0.607 against the retrained reference’s 0.635, below the model that never saw the data. On VeRi-776 the probe cannot separate the original model from the reference at all, +0.003, while fine-tuning, which leaks at entropy 0.93, reads 0.032 below the reference. Only RegDB behaves, +0.184 for the payload and +0.107 for the original, and RegDB is the one benchmark whose two pools are the same size and drawn from one protocol.

The cause is the deletion unit rather than the probe. Under identity-level deletion $\mathcal{U}$ and $\mathcal{Q}$ are disjoint identity sets of different sizes and difficulty, so separability between them is dominated by the pools themselves and membership is a small perturbation on top. Grouping removes the shortcut of learning the identities; it cannot remove the difference between the pools. An instrument that reads a knowledge-bearing model below the null is not reporting leakage, so we report the measurement and not the column.

Reading the four columns. They do not share an anchor, and only two of them have a meaningful absolute value. $\mathcal{U}$ mAP is not read against zero: the reference never trained on $\mathcal{U}$ and still retrieves it far above chance, because identities are visually coherent and the embedding generalizes, so the quantity of interest is the distance to the reference’s own $\mathcal{U}$ mAP. MIA$_{\mathrm{ent}}$ is uncalibrated and its scale depends on how far $\mathcal{Q}$ sits from the training distribution, so it too is read against the reference in the same column. RMIA and U-LiRA subtract the reference population from the target by construction, so a genuine retrain sits at $\frac{1}{2}$ and that value is meaningful: a score far below it is as distinguishable as one equally far above, since an adversary can invert its decision. Finally, no column certifies removal alone. An attack at the null reached while retrieval collapses is over-forgetting rather than unlearning, which is why utility and privacy are read together.

The threat model

The guarantee is about one artifact under one release policy, and both have to be named before an attack result means anything.

The released artifact. Honoring a request means shipping $\theta_{c}$ with the branch removed. What a downstream party receives is the backbone and the retrieval feature read before the BNNeck, a 3840-dimensional embedding on the ViT configuration. The classification head is a training artifact. It is not part of what is released, and the membership attacks in this paper read it anyway, so every attack number here scores a strictly larger object than the deployed one.

Adversary capabilities. The adversary holds $\theta_{c}$ in full, white box, and may compute any function of it: embeddings for chosen images, logits through the head it was not given, gradients, and any statistic of the parameters. It knows the deletion protocol, the architecture, the schedule, the sizes $|\mathcal{D}_{r}|$ and $|\mathcal{U}|$, and it may train its own reference models on data of its choosing. This is what the calibrated attacks assume, and it is why they are run with reference families rather than against a fixed threshold.

Artifacts withheld from the adversary. The payload, the original model, and any intermediate checkpoint of the co-trained run. A party holding the payload alongside Core recovers the deleted capability by design, which is the point of keeping the two separate. Nothing here claims that a controller who retains the payload has deleted anything. The claim is about $\theta_{c}$: every input it depends on, the initialization, $\mathcal{D}_{r}$, the Step-1 randomness and the retain-only teachers, is free of $\mathcal{U}$, so releasing it discloses no more about $\mathcal{U}$ than releasing a model trained without it.

Timing of the deletion request. Prop. 1 covers a set named before the core is trained. A later request naming identities the core already learned is outside it, since the initialization the induction starts from would then depend on those identities. Applying isolation to a trained model inherits nothing from the proposition, and Table 12 shows it does not recover the behavior either: the core keeps the full-data accuracy and stays identifiable.

Method	Core		Full		Core MIA, AUC
	mAP	R-1	mAP	MIA_H	RMIA	U-LiRA
Original, trained on $\mathcal{D}_{\mathrm{full}}$	88.0	94.8	–	0.999	0.991	0.979
Retrained reference: retrain on $\mathcal{D}_r$	86.9	86.9	–	0.493	0.511	0.511
MoME-Core, by design	74.3	88.2	82.0	0.492	0.511	0.513
Naive post-hoc, no isolation	88.5	95.2	88.8	0.997	0.967	0.909
PH1: freeze backbone	88.0	94.8	88.4	0.999	0.991	0.979
PH2: isolation, low LR	88.4	95.0	88.5	0.994	0.984	0.957
PH3: isolation + LR restart	87.8	94.7	88.4	0.967	0.968	0.927

Scope of the guarantee. Remark 2 states the boundary formally. The guarantee is relative to this training run. Whatever a public pre-trained initialization already encodes about a requested identity is not something isolation can remove, and no claim here reaches it. Nor does the guarantee say anything about $\mathcal{D}_{r}$, which Core legitimately learns.

The coupling channels, audited

A natural experiment for isolation. Two rows of Table 5 give the claim a test nobody has to design. The $\gamma$ only and $\beta$ only variants change what the parasitic branch is made of while leaving the retain set, the seed, the schedule and the data order untouched, so isolation predicts that the core comes out the same. Comparing the two checkpoints tensor by tensor, 201 of the 211 core tensors are bitwise identical. The ten that differ are exactly the running mean and running variance of the five BNNeck modules, which are buffers written by the forward pass rather than parameters reached by a gradient. Their difference is not small, up to 0.97 in absolute value, and it changes nothing that ships: perturbing every running statistic in the network leaves the deployed retrieval feature unchanged to the last bit. The two variants also read the same on the attack, 0.4873 against 0.4873, and differ only where they should, in Full mode at 78.1 against 77.8 mAP.

Size of the admitted channel. A4 does not close the random stream, it bounds what can cross it to a count of forget batches, and the size of that effect is measurable. Training the same seed with Step 2 disabled gives a core that differs from the deployed one by 1.26% of its norm over the 196 core parameter tensors, while the BNNeck running statistics, which are buffers rather than parameters, differ by 73.8%. For scale, the deployed core sits 12.9% from a retrain on the same $\mathcal{D}_r$, and between 12.9 and 13.2% from each of that retrain’s five seeds. So everything Step 2 does to the core, which by construction is the random stream and nothing else, amounts to about a tenth of the distance between two models trained on the same data, and it does not move the reading: the two score 0.492 and 0.491 on the entropy attack and agree to 0.002 on both calibrated ones.

Assumption 1 names five conditions under which isolation is exact. Those conditions are about paths from data to parameters, and a path can exist outside the gradient. The list below names every path we could identify in this implementation and what closes it. Two are closed by measurement rather than by construction, and both are reported. The head Batch Normalization statistics are the subject of Table 17. The decision of whether to apply an update was originally taken once for both parameter groups, which is a content-carrying path, since whether a batch overflows depends on the batch; the decision is now taken per group, by testing each group’s clipped gradient norm on its own. It is not the scaler’s decision and it does not depend on the scaler, which every run here constructs disabled since all of them train in bfloat16. The loop counts each drop and reports the total once an epoch. That counter ends at zero in every run that carries it, one of the Core-only runs among them. The deployed runs predate the counter, so there the path is closed by the per-group decision and not by a log. The classification head and the positional embeddings are core parameters, and what closes them is the freeze rather than a check, since Step 2 clears the gradient flag of the whole core group. The one check inside the loop looks for the opposite leak, a parasitic gradient during Step 1, and it passes in all eighteen: twice per run where it is gated, and in the Core-only runs, where it is not, at every one of their 46460, 11560 and 15480 iterations. None of the loop’s exceptional paths ran either.

Setting	Core mAP	Full mAP	MIA$_{\mathrm{ent}}$ on $U$
Default	74.34	81.99	0.493
BN freeze	75.12	80.07	0.487

The iteration that skips a non-finite Step-1 loss, the fallback to a core-only step on a non-finite Step-2 loss, and the mixed-precision fallback each log when taken, and none of those lines appears in the fifteen deployed runs or the three Core-only ones. Every iteration of every run reported here took the path Prop. [1] describes.

LayerNorm statistics. Computed per sample, so no running buffers exist. The built model carries 25 buffers and every one of them sits on a BNNeck, across 31 LayerNorm modules.

Head BN statistics. Buffers, so no gradient, and training normalizes by batch statistics, so no core gradient reads them. Retrieval reads the feature before the BNNeck, and perturbing every running statistic leaves that feature bitwise unchanged, checked on the deployed checkpoint by shifting all ten running means and rescaling all ten variances, after which the 3840-dimensional feature is equal bit for bit. Freezing them in Step 2 keeps the buffers themselves free of $\mathcal{D}_f$; measured in Table 17.

Optimizer momentum. Per-parameter buffers, so the core buffer sees Step-1 gradients only.

Gradient clipping. Clipping both groups together would leave Core’s update depending on the size of the Step-2 gradient, since one factor rescales everything once the joint norm passes the threshold. The two groups are clipped separately, at the same bound of 5. Two exceptional paths clip jointly and neither is a channel here: the Core-only control, where no Step 2 gradient exists to mix in, and the branch taken when the Step-2 loss is non-finite, which no run reported here entered.

Mixed-precision scaler. The reported runs use bfloat16, where no loss scaling is applied and the scaler is constructed disabled, so no scale is shared.

Which update is applied. Taken separately for the two parameter groups. Whether a batch overflows depends on that batch, so a joint decision would carry content and not only a count. A non-finite forget-batch gradient zeroes the parasitic group alone and the core update is applied as computed. Across every checkpoint reported here the path was never taken.

Dropout randomness. Masks drawn independently of the input.

Augmentation and sampling randomness. Step 1 draws over $\mathcal{D}_r$ through its own loader; the two loaders share one pseudo-random stream, so the only quantity that can cross is how many forget batches were drawn, never their content.

Activation cache. Gradient checkpointing is off, so no Step-2 activation is replayed into a core backward pass.

Classification head. A core parameter; its columns are restricted to retained identities in Step 1 and it has no gradient in Step 2. The tensor is allocated at full width, so a requested identity’s column exists and is never trained: on Market-1501 those 376 rows carry 0.0235 of norm against the retained rows’ 0.5419, and they are bitwise identical between the deployed run and the Core-only control, which share a seed and nothing else.

Positional and side embeddings. Core parameters, gradients only in Step 1.

Completeness of the normalization affine parametrization

The completeness holds within the per-channel class only. A normalization shadow rescales channels the frozen core already produces and cannot mix them, so any direction outside the core span stays unreachable no matter how the affines are set. Low-rank projection branches enlarge the reachable class and raise Full mode capacity during training, yet no branch trained from zero at any capacity we tried matches the original model on retrieval, the co-trained one reaching 82.0 mAP on Market-1501 against the original’s 88.0. The deployed payload is a different object, initialized at the exact parameter difference and then refined, and Prop. 3 delimits the normalization shadows alone rather than the branch as a whole, which also carries the low-rank pairs.

Low-rank structure of the parasitic gate

Prop. 3 shows that the parasitic affine parameters are complete: they can realize any per-channel gate at a normalization site. Empirically the learned gate is also low-rank. Stacking the per-channel parasitic scales $\gamma_m$ across all 36 normalization sites of the Market-1501 MoME model into a $36 \times768$ matrix and taking its SVD, we find that 95% of the spectral energy lies in the top 22 components, as Figure 5a shows, far above a uniform spectrum; the result is stable across all five seeds, with 36 sites, $r_{95}=22$ and the same eight silent sites in every one, and $\sigma_1$ between 29.1% and 29.8%. As Figure 5b shows, within the backbone the energy concentrates in the normalization that precedes the MLP branch rather than the one that precedes attention, by 54 to 46% of the backbone energy, and every block from 0 to 8 puts more there while blocks 9 and 10 invert it, the single largest backbone site being the pre-attention norm of block 10 at 5.5%; meanwhile block 11, the final norm and the bottleneck sites are bypassed and carry exactly none. The two largest single sites lie outside the backbone on every seed: the final LayerNorms of the two JPM branches hold 7.4 to 7.9% of the energy each, while no backbone site exceeds 5.5%, so the gate acts most strongly where the branch descriptors are normalized before retrieval. The gap between the retain and full behaviors therefore occupies a compact, structured subspace, which is why the gating part of it is carried by the normalization affines. Those affines are diagonal and cannot mix channels, so the deployed branch adds the zero-initialized low-rank pairs of Sec. 3 on the linear maps.

This structure is learned, not imposed. Prop. 3 guarantees only that the parasitic affines can realize any per-channel gate; that the trained gate then collapses onto 22 of the 36 available singular directions, and onto the pre-MLP normalizations of the middle blocks, is a property of the retain-to-full gap itself. It accounts for three observations at once. The gate fits in the normalization affines because what it has to express is not spread across the backbone but confined to a compact subspace those affines span. This is a statement about the gate the branch learns during co-training, not about the parameter difference to the original model: that difference is effectively full rank, which is why the deployed payload stores it densely rather than as a branch. Widening the parasitic scope cannot move Core through the branch at all, since Step 2 never reaches it; the small movement that remains arrives through the shared random stream of Assumption 1, measured at 1.26% of the core’s norm. What the scope changes is Full, and it changes it little, because the added directions fall almost entirely in the null space of that gap and carry no energy. And the concentration in the middle blocks, with the JPM-bypassed final block empty, places that knowledge in the layers that route mid-level features rather than in the early or final stages. The gate is thus complete in principle yet economical in practice, which is the property the switchable design relies on.

Generality across backbones, pretraining and tasks

Table 4 gives the four settings behind the claim in the body, each against a reference retrained on its own $\mathcal{D}_r$: the deployed ViT, a ResNet-50 AGW backbone, CLIP-ReID, and a ResNet-18 trained from scratch for CIFAR-10 classification. Core matches or beats its reference on utility on every row, by 3.7 mAP on the ViT, 14.2 on ResNet-50, 10.1 on CLIP and a dead heat on CIFAR-10, where both score zero on the deleted classes at every seed. The ResNet-50 margin is the largest, and neither side of it is seed noise: over five seeds the reference family spans 32.4 to 34.5 mAP and the core family 46.6 to 48.7. What separates them is that the core distills from an ensemble of such references, which a single from-scratch retrain on a thin retain set has no way to do.

What the statistic resolves differs sharply across the four settings, and the reference column says by how much. The retain-only family’s own spread is .085 on the ViT and .050 on the ResNet-18, so a Core deviation of a few hundredths would be visible there, but it is .241 on ResNet-50 and .232 on CLIP, which is half the scale. On those two backbones the Core reading carries no information about the forget set: a retrain against its own kind lands anywhere from 0.22 to 0.82, and Core sitting at 0.500 inside that is not evidence. The payload column is a different matter, since it leaves the band on every backbone.

The statistic separates the payload’s two failure modes by direction. The ViT payload restores $\mathcal{U}$ and lands at 0.100, the memorizing direction. On ResNet-50 and CLIP it does not carry $\mathcal{U}$ and deviates the other way, 0.880 and 0.896, and its retrieval on ResNet-50 is unstable rather than uniformly poor, 52.0 $\pm$ 18.8 mAP against a Core of 47.5 $\pm$ 0.9, collapsing on two seeds at 30.2 and 32.8 and recovering on three at 64.3 to 67.7. On CIFAR-10 it lands at 0.152, the memorizing direction, while its accuracy is chance, so what the branch carries is the forget set’s loss profile and not a usable classifier.

Class deletion on image-classification benchmarks

Table 3 gives the class-deletion comparison behind the claim in the body: a tenth of the classes is removed, $\mathcal{U}$ is every image of those classes, and the table reports retained-class accuracy, accuracy on the deleted classes and entropy-MIA of $\mathcal{U}$ against the test split at three scales. Every method is reimplemented against one ResNet-18, so all rows share a model, a split, a schedule and an evaluation, and every entry is a single run at seed 42.

No single column separates the methods. Fine-tune keeps retained accuracy and leaves the deleted classes recoverable, at 79.3% on CIFAR-10 and 91.3% on CIFAR-100. GA and NegGrad+ reach the null only because the model is destroyed, at 11.1% and 12.7% retained accuracy against the reference’s 94.3%. SalUn falls below the null, 0.01 against 0.26, which is over-forgetting rather than privacy, and does not hold across scales: on TinyImageNet it leaves the deleted classes at 95.6%. SCRUB is the one baseline that stays near the reference at all three scales, and no rule for combining the three columns is fixed in advance, so the comparison with it is column by column: on CIFAR-10 SCRUB is nearer on the attack, 0.24 against the reference’s 0.26 where MoME reads 0.31, while MoME is nearer on retained accuracy, 94.1% against 93.8% for a reference of 94.3%; on CIFAR-100 and TinyImageNet MoME matches the reference attack to 0.004 and 0.002, at 0.24 and 0.22, where SCRUB reads 0.28 and 0.20. The remaining baselines do not order consistently as the class count grows.

Deletion requests with a different unit

Everywhere else in this paper a request deletes whole identities: every image of a requested identity leaves, and $D_r$ keeps $k$ images of each survivor. A request need not arrive in that unit. This section changes the unit and retrains MoME from scratch under each variant, all on Market-1501 at seed 42. Camera skew deletes one fixed camera view per identity, so the request covers images rather than people and every identity is still present in $D_r$. Imbalanced draws a per-identity retain count $k \sim U[1,8]$, so coverage varies from one image to eight and again no identity leaves. Identity skew deletes fifty identities outright and keeps every image of the survivors, the classical class-removal regime and the only variant here whose unit matches the main protocol; its retain set therefore grows to 12,025 images.

The unit is what this table is about, because it decides what a membership attack is able to answer.

The retain set’s size is a separate axis, and the main text reports the unthinned control on one run. That run has an attack on it: with every image of the retained identities kept, so 6463 against the deployed 1491, the reference-free attack reads 0.4989 on Core against the retrain’s 0.4957. No reference family was trained for that protocol, so the calibrated attacks cannot be read there, and the pair is one run each at one seed.

Table 10 reports the outcome. Core utility never falls below the uniform protocol: it reads 76.2 mAP under the camera skew, 81.3 under the imbalance, and 87.5 under identity skew, where the far larger retain set simply gives the model more to learn from. The attack column separates two things that are easy to confuse. Identity skew deletes whole identities, and every attack on it sits near the exchangeable value, at 0.541, 0.517 and 0.518. That row also carries the only evidence here on the size of a request rather than its unit: it deletes fifty identities where the main protocol deletes 376, and the two calibrated attacks read 0.517 and 0.518 against the main protocol’s 0.51 and 0.51, so a request seven times smaller does not move them. It runs the base configuration, without the distillation ensemble or the low-rank pairs, so it is not a like-for-like comparison with the deployed recipe. Camera skew and the imbalanced draw leave every identity present in $D_r$, and the uncalibrated entropy attack reads 0.872 and 0.917, because an attack that asks whether an identity was trained on is answered yes however completely those particular images were forgotten.

Retain set skew	$\lvert D_r\rvert$	Core mAP	Full R-1	Full mAP	MIAH	RMIA	U-LiRA
Uniform $D_r$, identity-level	1,491	74.3	88.2	82.0	0.492	0.511	0.513
Camera skew, delete cam-0	2,954	76.2	88.3	83.6	0.872	0.559	0.652
Identity skew, delete 50 PIDs	12,025	87.5	94.5	86.0	0.541	0.517	0.518
Imbalanced $k \in[1,8]$	3,222	81.3	91.8	84.1	0.917	0.548	0.711

Calibration is what separates the two questions. Scored against a family retrained on the same skew’s $D_r$, which carries the same identities, that confound largely cancels: RMIA falls to 0.559 and 0.548 on the two identity-preserving skews. What survives, up to 0.711 on the imbalanced draw under U-LiRA, is the image-level signal, which is the part a deletion request over images can actually be held to. MoME is thus robust to how $D_r$ is sampled, and an attack score means what the reference family lets it mean.

Resolution against request size

The protocol everywhere else names half the identities. A request under a right to erasure names far fewer, and retraining at every size is out of reach, so we answer the half of the question that the stored scores already settle. Holding the deployed models fixed, we restrict the audit to a random subset of the requested identities, redraw the subset twenty times at each size, and record what the reading and its interval do. This separates the resolution of the statistic from the behaviour of a model trained on a smaller request, which is a different question we do not answer, and it is the half a controller needs, since it says how many identities a request must name before a null reading carries information.

Tab. 11 gives it. Two readings. The positive control survives all the way down: the consolidated payload is detected at every size, reading 0.926 on five identities where the interval half-width is 0.066, so a leak of that size is caught by a request naming five people. The null reading does not survive nearly as far. Core and the retrained reference stay together at every size, which is the result, but the interval around them widens from 0.022 at the full request to 0.046 at fifty identities and 0.153 at five. At five identities the audit cannot resolve a difference below about 0.3, so a null there is not evidence of anything. Reading the column against the 0.04 the full request resolves, a request has to name on the order of a hundred identities before the calibrated attacks are as informative as the tables elsewhere in this paper. The other two benchmarks give the same picture at their own scales. On VeRi-776 the half-width runs from ties, and every attack on it sits near the exchangeable value, at 0.541, 0.517 and 0.518. That row also carries the only evidence here on the size of a request rather than its unit: it deletes fifty identities where the main protocol deletes 376, and the two calibrated attacks read 0.517 and 0.518 against the main protocol’s 0.51 and 0.51, so a request seven times smaller does not move them. It runs the base configuration, without the distillation ensemble or the low-rank pairs, so it is not a like-for-like comparison with the deployed recipe. Camera skew and the imbalanced draw leave every identity present in $D_r$, and the uncalibrated entropy attack reads 0.872 and 0.917, because an attack that asks whether an identity was trained on is answered yes however completely those particular images were forgotten.

Calibration is what separates the two questions. Scored against a family retrained on the same skew’s $D_r$, which carries the same identities, that confound largely cancels: RMIA falls to 0.559 and 0.548 on the two identity-preserving skews. What survives, up to 0.711 on the imbalanced draw under U-LiRA, is the image-level signal, which is the part a deletion request over images can actually be held to. MoME is thus robust to how $D_r$ is sampled, and an attack score means what the reference family lets it mean. 0.025 at the full 288 identities to 0.115 at five while the payload holds between 0.883 and 0.897; on RegDB, whose full request is only 103 identities, it runs from 0.043 to 0.155 while the payload holds between 0.838 and 0.863. On all three the reference and Core stay together at every size, so what the request size changes is the resolution and not the result.

The rank statistic degrades far more slowly, and the same subsetting shows it. Its band, the spread of the retrained family’s leave-one-out readings, widens only from 0.0845 at the full request to 0.0863 at fifty identities and 0.1260 at five, a factor of 1.5 where the attack interval widens by 7. Its positive control does not degrade at all: the consolidated payload read against the Core family sits at 0.100 at every size down to five identities, which is the floor of the rank scale, so it stays 0.40 from the null against a band of 0.126, or 3.2 of that band’s standard deviations. Part of that robustness is structural, since a control already at the floor of a bounded scale has nowhere to fall, but the band widening slowly is not: it is what makes the floor readable. Where the calibrated attacks stop resolving anything at five identities, the rank test still separates a leaking readout from the null. VeRi-776 repeats it more sharply: its band moves from 0.1013 at the full 288 identities to 0.1105 at five, a factor of 1.1, and the control sits at exactly 0.1000 at every size. That band is wider than Market-1501’s in absolute terms, so the rank test resolves less there overall while losing almost nothing as the request shrinks.

Identities named	Core	Retrain	Full	half-width
5	0.518	0.534	0.926	0.153
10	0.510	0.522	0.937	0.092
25	0.504	0.518	0.943	0.067
50	0.519	0.507	0.944	0.046
100	0.511	0.509	0.944	0.036
200	0.515	0.515	0.939	0.028
376	0.511	0.511	0.942	0.022

Toward post-hoc unlearning

MoME unlearns by design: Core is optimized from initialization and never sees $D_f$. A natural question is whether the same parasitic and core split can be retrofitted onto a model already trained on the full data, the setting most unlearning methods target. Table 12 tests it over four schemes

at 30 epochs starting from the deployed checkpoint, and the answer is no. All four keep the full-data accuracy, 87.8 to 88.5 mAP against the original’s 88.0 where the retrained reference reads 70.5, and all four stay identifiable, 0.967 to 0.999 on the entropy attack and 0.967 to 0.991 on RMIA where the reference reads 0.493 and 0.511. Gradient isolation does not change that. It withholds new forget-set gradients and cannot remove what the weights already carry.

The four differ only in how far they are allowed to move the backbone, and none of them leaves its full-data solution in 30 epochs. PH1 makes this explicit by freezing the backbone: its Core is the original model, and it reads the original’s three attack scores to four decimals, 0.9986, 0.9907 and 0.9786. PH2 and PH3 let the backbone move under isolation, at a low rate and at a restarted one, and both land within a point of where they started. Naive, which applies no isolation at all, is not distinguishable from the three that do.

This is what Prop. 1 predicts rather than a failure of the schedule. The induction that makes Core independent of $\mathcal{U}$ starts from an initialization that never saw it, and a core that begins as a function of the forget set stays one under any later restriction of its gradients. A retrofit can reproduce the mechanism and not the guarantee, and here it does not reproduce the behavior either. Both Full columns are the full-data model reached by a different route, and neither carries information the matching Core lacks, which is why the switch is not the interesting quantity in this table.

Repeating this across seeds and across the other two benchmarks is not done. An earlier version of this study reported such a repetition, and those runs named the deployed checkpoint on the command line while leaving the initialization flag at its default, so they trained from ImageNet weights and measured a schedule rather than a retrofit. They are withdrawn rather than reinterpreted.

A rejection region for the rank statistic

The aggregate $\rho_U$ over a leave-one-out family is a counting identity. With $K$ shadows and no ties, the $K$ ranks a sample receives as each model takes its turn as target are a permutation of $\frac{2i-1}{2K}$, so their mean is exactly $\frac{1}{2}$ whatever the family did. Reading $\frac{1}{2}$ back off that average is not evidence, and a test needs a unit, a rejection region and a calibration.

The within-family reading. Core is ranked among shadows of its own procedure. Ranking it among the retrains it is compared against is the other reading, and it cannot separate them. Ranking Core against the five retrained references on Market-1501 puts it at 0.083 on every seed, which is the floor of the scale at six models, and ranking the consolidated payload against the same five puts it at 0.083 as well. The reading that is supposed to separate them cannot, because Core’s loss on $U$ is below all five references on every forgotten sample.

That is generalization and not memory, and the retain set says so. On the Market-1501 images both procedures trained on, Core is above all five references rather than below them, at a mean loss of 0.313 against 0.172: the references fit their thin retain set harder than Core does, while Core is the better model on identities neither ever saw. Throughout this subsection a loss is the deployed Core against the five-seed mean of the reference family. A model carrying residual memory of $U$ would be the more confident one on the data it kept, not the less confident one. The cost of the within-family reading is real and we state it: a failure of isolation that affected the procedure itself would move every member together and the leave-one-out reading would not see it, which is why the power of the statistic is demonstrated with planted violations rather than claimed from the deployed number.

The unit is one model paired with one identity, since a violation is coherent inside an identity and nowhere else. For model $t$ and identity $i$ contributing $n_i$ scored images let $m_{t,i}$ be the mean rank and

where $K$ is the number of models a sample is ranked among, so a single rank takes $K$ equally spaced values and $\sigma_1$ is their standard deviation. A two-image identity at the floor and a fifty-image identity slightly below the middle are thereby placed on one scale, and under exact exchangeability $z$ has unit variance. On Market-1501 with $K=5$ and the 376 deleted identities this gives 1880 cells per family. This is a different spread from the one Table 4 reports: there the unit is a whole model and the number is how far one seed’s $\rho_U$ falls from another’s, here the unit is one identity inside one model.

Table 13 reads as follows. Both leave-one-out families have mean zero by the counting identity. The retrained family, which by construction never saw the deleted identities, already carries a standard deviation of 2.68 against the analytic 1, and 137 of its 1880 cells sit beyond the nominal 5% family-wise threshold of 3.8. What that measures is the correlation just described rather than a failure of Prop. 2: seeds land in different optima and an identity is easy or hard coherently across its images, so permuting the model axis independently per image destroys a dependence that is present under the null and makes the simulated null too narrow. A permutation test against it rejects for the retrained family at $p \le0.005$, so that test is not usable and we do not use it. MoME-Core reads 3.15 and 220 cells, the same order as the retrained family.

Family	sd	p99	max	above 3.8
Retrain	2.68	6.30	9.63	137
MoME-Core	3.15	7.19	10.23	220
Full vs Core	1.80	10.86	12.00	1520

What separates a model that kept the data is of a different order. Reading the consolidated payload against the Core references moves the whole distribution rather than its tail: the mean goes from 0 to 5.59 and 1520 of 1880 cells clear the threshold. The instrument has power, and the gap between the two leave-one-out families is small next to the gap either has to the payload. This is the same conclusion Table 20 reaches with planted violations, reached here without planting anything.

Violation	Kept	$\rho_U$	$\sigma$	Identity AUC	Clean at floor	RMIA AUC	95% int.
2%	14	0.5102	+1.3	0.9995	2.0%	0.531	[.512, .550]
5%	34	0.4793	−2.6	0.9973	5.5%	0.542	[.522, .562]
10%	68	0.4820	−2.3	0.9921	7.2%	0.562	[.541, .585]
25%	169	0.4645	−4.5	0.9940	7.3%	0.635	[.611, .659]

The families on all three benchmarks. Table 14 lists them. The deployed Core reads 0.538, 0.487 and 0.494, each inside the range its own retrained family spans, and the spread of that reference family is what sets the resolution on each benchmark. Two things are worth reading off it. The mean of every family is exactly 0.5000, which is the counting identity and not a result. And a family of from-scratch retrains spreads two to four times as wide as a family of MoME cores on every benchmark, which is the same instaṣ bility the retrain shows on retrieval, so the band a deployed audit is read against is set by how unstable retraining is on a thin retain set.

Family	leave-one-out $\rho_U$	sd
Market retrain	0.603 0.525 0.400 0.427 0.544	.085
Market Core	0.538 0.480 0.486 0.501 0.495	.023
VeRi retrain	0.559 0.354 0.553 0.437 0.597	.101
VeRi Core	0.487 0.522 0.440 0.544 0.507	.040
RegDB retrain	0.611 0.392 0.582 0.487 0.428	.095
RegDB Core	0.494 0.539 0.520 0.509 0.437	.039

Table 14. Forgetting-Rank families on all three benchmarks. Each row gives the five leave-one-out readings of one family, deployed seed first, and their sample standard deviation. Every family averages 0.5000 by the counting identity, so the spread is the informative quantity. Red: the deployed Core, whose own reading is in bold.

Membership inference diagnostics

The analyses below accompany the privacy results of § 3: which member pool the signal comes from, where the retained accuracy comes from, the one buffer that could leak outside the gradient path, the low false positive region, the choice of a reference family over a single reference, and the Forgetting-Rank in full.

Which member pool the attack is asked about. A single membership number mixes populations that behave differently, and only one of them is about removal. Table 16 scores four pools against the same query non-member set. The reference sets the pattern. It reads 1.000 on $D_r$, the images it trained on, and 0.938 on the images of those same identities that $D_r$ did not keep, which it never saw: an identity the model learned makes its other images look like members, so a high score there is generalization rather than memorization. On $U$, whose identities the reference never met, it reads 0.493, at chance. Core reproduces all three, at 1.000, 0.945 and 0.493. The consequence is that the whole training set reads 0.722 for the reference and 0.725 for Core, far above chance for two models that forgot correctly, which is why a pool built as the complement of $D_r$ cannot certify anything. The failure cases frame the reading: Fine-tune stays at 0.982 on $U$ and gradient ascent above 0.99 on every pool alike, identifiable everywhere rather than selectively forgetful. Full, which by design encodes $D_f$, reads 0.998 on $U$, which is where a knowledge-bearing readout belongs.

Method	$\mathcal{D}_f$	$U$	$\mathcal{D}_r$	retained, held out
Original	0.996	0.996	0.996	0.997
Fine-tune	0.990	0.982	0.999	0.998
GA	0.994	0.994	0.991	0.996
Retrain	0.722	0.493	1.000	0.938
Core	0.725	0.493	1.000	0.945
Full	0.998	0.998	0.997	0.999

Source of the retained accuracy. The same three pools separate retrieval, and Table 15 reads them. Core leads the retrained reference on $U$ by 2.8 on Market-1501 and 5.3 on VeRi-776, and leads it by 3.9 and 4.4 on the retained identities it never trained on. The two gaps move together, so the lead on $U$ is the same generalization that shows up on data nobody asked to delete, not memorization of the deleted identities. How much generalization there is to have is easy to understand from the mAP column alone: the reference’s Rank-1 on $U$ is 90.1 on Market-1501 and 64.8 on VeRi-776, so a model that never trained on these identities still puts another of their images first most of the time. Over five seeds the Market gaps read 2.98 and 4.08 and the VeRi-776 gaps 8.36 and 7.91, so neither ordering is a seed artifact, and both benchmarks put the two gaps within 1.1 of each other while the gaps themselves run from 3 to 8. The left column is where the two differ most and it is not a privacy quantity: both fit $D_r$ almost exactly on Market-1501, 100.0 against 99.8, while on VeRi-776 Core reads 99.9 and the reference only 56.0 at this seed, against 52.7 over five. A from-scratch retrain on 1152 images does not converge on its own training set, which is the same instability its five seeds show as a 5.1 spread in test mAP, and it is why the reference is weak on that benchmark rather than why Core is strong.

Dataset	Method	$D_r$	retained, held out	$U$
Market	Retrain	99.8	86.4	77.3
	MoME-Core	100.0	90.3	80.1
	MoME-Full	99.8	99.8	99.8
VeRi	Retrain	56.0	47.7	35.5
	MoME-Core	99.9	52.1	40.8
	MoME-Full	100.0	100.0	100.0

Table 15. Retrieval mAP on the three parts of the training set at seed 42, under identity-level deletion. The retained, held out column holds images of retained identities that were never in $D_r$, so high values there are generalization rather than leakage. Full is the consolidated payload, the artifact reported in Table 1, not the parasitic branch as trained. Every row here is one run on the deployed split, where Table 1 averages five splits, which is why Core reads 80.1 on $U$ here against 80.5 there while the Market reference reads 77.3 in both. The same gap is larger on VeRi-776, 35.5 here against 32.2 there for the reference, because that reference is the unstable one: its five seeds span 27.6 to 39.5 mAP.

Batch Normalization side channel. Gradient isolation controls what the gradients touch, but the classification heads carry Batch Normalization, whose running mean and variance are updated by the forward pass rather than by gradients. A Step-2 pass over $D_f$ could therefore in principle write forget-set statistics into a buffer that Core later reuses, a leak outside the gradient path. Table 7 tests this by freezing those statistics during Step 2 and comparing against the default. The membership attack on $U$ moves by 0.006, so the buffer carries no meaningful $D_f$ signal and the LayerNorm-backbone configuration is safe without the freeze. The channel is specific to Batch Normalization, which is why it is absent on the LayerNorm backbone yet must be closed on the BN-normalized CNNs of the generality study. Those runs did not close it. Their ResNet-50 carries one set of running buffers for fifty-five backbone sites, shadowed only at the BNNeck, so Step 2 wrote $\mathcal{D}_f$ statistics into buffers Core reads. No privacy claim is made on that backbone for a different reason, that its band resolves nothing, and this is a second.

Row	AUC	95% int.	difference, 90% int.
Market
Retrain	0.511	[.491, .529]	–
Core-only	0.511	[.490, .534]	+.001 [−.021, +.023]
Core s42	0.511	[.488, .533]	+.000 [−.022, +.023]
Core s123	0.505	[.484, .527]	−.005 [−.027, +.017]
Core s456	0.513	[.492, .535]	+.003 [−.019, +.026]
Core s789	0.507	[.485, .529]	−.003 [−.025, +.020]
Core s1024	0.512	[.490, .534]	+.001 [−.022, +.025]
Full	0.942	[.930, .952]	+.431 [+.413, +.450]
RegDB
Retrain	0.511	[.467, .554]	–
Core-only	0.516	[.470, .561]	+.006 [−.044, +.054]
Core s42	0.526	[.481, .571]	+.016 [−.031, +.063]
Core s123	0.569	[.524, .614]	+.059 [+.011, +.106]
Core s456	0.531	[.487, .576]	+.021 [−.024, +.065]
Core s789	0.557	[.511, .601]	+.046 [−.000, +.093]
Core s1024	0.554	[.506, .601]	+.043 [−.006, +.094]
Full	0.842	[.806, .874]	+.331 [+.289, +.374]

The audit statistic in detail. Figure 6 separates what the Forgetting-Rank calibrates from where its power lies. The per-sample rank density of Core, in red, is flat, carrying exactly 0.200 of the mass at each of the five levels at $\chi^2 p=1.0$, for a mean of $\bar{\rho}_U=0.500$. That flatness is the null being exactly calibrated rather than a reading about Core: the ranks of one family are a permutation across its targets, so the pooled density is uniform by a counting identity whatever the model did, and the retrained reference reads the same 0.500 for the same reason. Power comes instead from comparing across families, which no identity constrains. The identical network read in Full mode, in grey, whose parasitic branch was trained on $U$, is scored against the other seeds’ Core and sits at the floor of the rank scale for 99.98% of forgotten samples, at $\bar{\rho}_U=0.100$. Images of one identity are not independent, so the count that matters is taken over identities: of the 1880 identity readings the five models give, every one falls below the null and 1877 sit at the floor, with a spread across them of 0.007. This is why we report the statistic as a diagnostic with an explicit positive control rather than as the paper’s privacy result, and why the test that carries a rejection region, Sec. B.12, takes the identity rather than the family average as its unit.

The low false positive region. An ROC-AUC averages

over every operating point, including ones no adversary would use. A membership claim is made where the false positive rate is small, so Table 18 reports the true positive rate at 1% and 0.1% false positives alongside the AUC. The size of the non-member pool sets what these columns can resolve, and it is small. On Market-1501 the attack scores 6473 members against 3368 non-members, so 1% false positives means 33 of them and 0.1% means 3, a threshold fixed by three samples. A rate of 0.01% is not attainable with this many non-members and is not reported. VeRi-776 offers 1678 non-members and RegDB 2060, which is why Table 19 carries the 1% column alone across the three benchmarks. The ordering is the same but the separation is much wider. At 1% false positives the retrained reference recovers 1.2% of the forgotten members, which is chance, and Core recovers 1.0%. Two other rows come within that range, LOFT at 1.3% and NegGrad+ at its most aggressive rate at 1.7%, and neither is forgetting: LOFT still retrieves the deleted identities at 99.6 mAP, and that NegGrad+ point retrieves at 28.2 mAP overall. Every remaining row recovers between 4.0 and 80.5%. This column is therefore not a ranking on its own, which is the same reason the AUC is not one. The consolidated Full recovers 38.2%, which is the payload being detected as designed. Table 19 repeats the 1% column on all three benchmarks. The reading is the same everywhere: the reference recovers 0.012, 0.004 and 0.011 of the members, Core recovers 0.010, 0.017 and 0.020, and the payload recovers 0.382, 0.205 and 0.184. SSD is the one row that falls below chance on two benchmarks, which is the over-forgetting direction rather than a privacy gain. LOFT is the sharpest case of a row that reads clean in one place and not in another: 0.013 on Market-1501, which is chance, against 0.596 on RegDB, where the same method recovers three in five of the deleted images at a 1% false positive rate.

Method	RMIA AUC	RMIA TPR @ 1%	RMIA TPR @ 0.1%	U-LiRA AUC	U-LiRA TPR @ 1%
Original	0.99	0.784	0.358	0.98	0.356
Fine-tune	0.98	0.805	0.485	0.97	0.525
GA	0.98	0.744	0.381	0.97	0.327
NegGrad+	0.99	0.773	0.400	0.98	0.342
SalUn	0.88	0.302	0.122	0.87	0.200
Bad Teacher	0.86	0.311	0.137	0.85	0.156
LoRA	0.99	0.772	0.413	0.98	0.354
SSD	0.28	0.040	0.022	0.31	0.019
SCRUB	0.99	0.717	0.356	0.97	0.282
LoTUS	0.78	0.161	0.040	0.74	0.158
MUNBa	0.98	0.684	0.426	0.97	0.448
LOFT	0.32	0.013	0.002	0.39	0.014
Retrain	0.51	0.012	0.000	0.51	0.009
MoME-Core	0.51	0.010	0.001	0.51	0.010
MoME-Full	0.94	0.382	0.097	0.85	0.071

Method	Market-1501	VeRi-776	RegDB
Original	0.784	0.254	0.169
Fine-tune	0.805	0.321	0.391
GA	0.744	0.088	0.347
NegGrad+	0.773	0.004	0.155
SalUn	0.302	0.061	0.293
Bad Teacher	0.311	0.023	0.348
LoRA	0.772	0.003	0.174
SSD	0.040	0.001	0.000
SCRUB	0.717	0.002	0.038
LoTUS	0.161	0.001	0.098
MUNBa	0.684	0.011	0.134
LOFT	0.013	0.003	0.596
Retrain	0.012	0.004	0.011
MoME-Core	0.010	0.017	0.020
MoME-Full	0.382	0.205	0.184

Core against the reference family, not against one reference. A single pair of numbers cannot support indistinguishability, so Table 9 gives both sides as distributions on all three benchmarks. Each family is scored by ranking each of its five retrains against the other four, which is the spread a retrain has against its own kind, and Core’s five seeds are read against that rather than against one draw from it. The gap to any baseline that keeps its retrieval is two orders of magnitude larger on the true positive rate.

Detection power against a planted violation. The controls above read a model that was trained honestly. To measure what the statistic can catch, we train models that silently keep a fraction of the requested identities in the core update, so the deletion request is unchanged and only compliance is violated. Table 20 scores them against five clean shadows. A kept identity pins at the floor of the scale, which is 1/12 here because the target sits outside the family and the mid-rank runs over six models. Every clean shadow beats the target on its images, while a clean for-

gotten identity stays uniform and reaches the floor only 2 to 7% of the time. The aggregate separates from the null at a 5% violation and beyond, by 2.3 to 4.5 standard deviations of the clean family, whose five leave-one-out readings span 0.4908 to 0.5140. The 5% and 10% readings differ by less than half that spread, so their order is not resolved. It misses the 2% case, where the reading even drifts high because the honest 98% of $U$ dilutes the leak. Ranking identities by their mean rank recovers it: the identity-level ROC-AUC is above 0.99 at every fraction, including the fourteen-identity leak the aggregate cannot see. In the form an audit would use it, opening as many identities as were kept, that is 13 of 14 at 2%, 31 of 34 at 5%, 59 of 68 at 10% and 158 of 169 at 25% out of the 676 requested, and at 2% every kept identity falls inside the top fifteen of that ranking. The same models settle whether anything other than the rank test sees these violations. Scored with the three membership attacks against the four disjoint references the main tables use, a control trained by the same recipe with the violation set to nothing reads 0.499 on RMIA and the four violations read 0.531, 0.542, 0.562 and 0.635. The calibrated intervals clear the control’s from 5% up and overlap it at 2%, by 0.005 on RMIA and 0.001 on U-LiRA; the uncalibrated entropy attack clears it only from 10%. So the smallest violation any of the three resolves is 5% of the request, the same as the aggregate rank reading and more than twice the fourteen identities the identity-level reading localizes at 0.9995.

These controls were trained on a 90% deletion split rather than the deployed one, and the five clean shadows are MoME cores rather than from-scratch retrains, which is why their leave-one-out spread of 0.0079 is an order of magnitude tighter than the 0.085 a retrain family spans at the deployed split. The $\sigma$ column therefore measures the power of the test, not the width of the band a deployed audit is read against.