The Safety Audit That Disappears When AI Gets Compressed

A team of researchers has shown that a language model can pass every safety check at full precision, then start behaving differently after it is compressed to run on a phone, laptop, or in-browser. The gap, formalized in an arXiv preprint by authors studying post-training quantization, sits between the version of a model that gets tested and the version that actually ships to users. The constructive version of the story is not that AI is broken; it is that the safety review is being run on the wrong artifact.

Quantization is the standard cost-cut for putting large language models on edge hardware. Practitioners reduce the numerical precision of a model's weights, for example from 16-bit floating point (FP16) down to 8-bit integers (INT8) or 4-bit integers, so the model fits in less memory and runs faster on consumer chips. The procedure is treated as a deployment optimization, separate from the safety review. The new paper's claim is that this separation is not safe. Because quantization is a many-to-one mapping over the parameter space, two models with identical full-precision behavior can collapse onto different quantized versions with different downstream behavior. Source-precision certification does not entail behavioral equivalence in the deployed configuration. The authors formalize this in what they call Quantization Behavioral Equivalence Classes (QBECs), and prove that membership in a QBEC does not imply behavioral equivalence in the deployed model.

To demonstrate the failure mode, the authors built a three-stage adversarial fine-tuning pipeline that plants a latent payload in a model. The payload passes source-precision behavioral checks, then activates when the model is compressed. They tested the attack on multilingual encoder-decoder translation models, the architecture behind systems like NLLB and mBART, and on a paired political-stance classifier. In the worst case, a translation model that scored zero on a friend-foe corruption benchmark at full precision flipped to 85.02% corruption after INT8 or 4-bit compression. A stance classifier built to measure ideological lean shifted by up to ΔBias=0.33 once quantized. The numbers are upper bounds under the paper's specific three-stage attack, and generalization to arbitrary deployed models or quantization recipes is unverified. They are evidence the gap is exploitable, not evidence that every compressed model is backdoored.

The result that practitioners should care about is not the headline inversion rate. It is that attack persistence varies across quantization schemes and across model architectures, and nominal bit-width alone does not predict whether a backdoor will fire. INT8 is not automatically safer than 4-bit; a backdoored full-precision model can survive some compression paths and not others. The validation–deployment gap is structural, and a single bit-width number in a procurement checklist will not close it. A model that passes every audit at FP16 can still ship a compressed version that has not been audited at all.

Run safety evaluations on the quantized artifact, not just on the source checkpoint, and treat cross-quantizer transferability as a first-class red-team question. Enterprise procurement teams can ask vendors whether the audit was run on the shipped model. Red teams can include compression paths in their threat models, the way they already test jailbreaks and prompt injection. Regulators drafting AI assurance rules can require that the audited artifact match the deployed artifact at the bit level, and that any change of representation trigger a new evaluation. The preprint, titled Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation–Deployment Gap, is an arXiv analysis, not a peer-reviewed venue paper, so the upper-bound numbers should be read as evidence the gap exists, not as production incident data.

The work extends a 2024 line of research from SRI Lab at ETH Zurich on exploiting LLM quantization, and it is the first paper to push the result from decoder-only causal language models into encoder-decoder multilingual translation. The project's authors have published a companion site with reproduction notes and a test harness. The open question is whether the same persistence pattern holds against production-grade quantizers, including the ones baked into widely used open-weight runtimes such as llama.cpp, GGUF, AWQ, and GPTQ.