Class unlearning for video segmentation aims to ensure that a removed category cannot be reconstructed from a deployed model's outputs. But a new preprint on arXiv argues that existing leakage evaluation algorithms are inadequate: they inspect one frame at a time, and the authors show that this approach fails to capture how information actually persists.
The key finding is that the privacy leak is carried by redundancy across frames, not by the motion trajectory. In other words, even if each individual frame appears to have forgotten the removed class, the repeated, overlapping information spread across frames can still allow an attacker to reconstruct it. This means that frame-by-frame checks give a false sense of security.
The authors therefore call for evaluation methods that explicitly account for temporal redundancy. Without such methods, video unlearning cannot be reliably verified, and supposedly removed categories may remain recoverable in practice. The study highlights a fundamental gap between how unlearning is tested and how video data actually leaks information.