Post-training quantization (PTQ) is frequently viewed as a semantically neutral optimization for deploying Large Language Models (LLMs) on edge devices. However, a recent study highlights that this process creates a structural "validation-deployment gap," which can be exploited to trigger latent backdoor attacks.
Theoretical Framework of QBECs
Researchers have formalized this gap using Quantization Behavioral Equivalence Classes (QBECs). Since quantization involves a many-to-one mapping within the parameter space, certification at source precision (FP16) does not ensure the model will behave the same way once deployed in a compressed format. This discrepancy allows for the embedding of malicious payloads that remain hidden during initial checks but activate when the model undergoes INT8 or 4-bit compression.
Experimental Findings and Impact
The study examined these risks in two specific contexts: tactical machine translation and political content analysis, extending the research from decoder-only models to multilingual encoder-decoder sequence-to-sequence models. The findings reveal significant security vulnerabilities:
- In translation models, friend-foe corruption rose from zero at the repaired FP16 level to as high as 85.02% inversion following quantization.
- A paired stance classifier measured an ideological shift of up to ΔBias=0.33 upon compression.
Further analysis of cross-quantizer transferability indicates that the persistence of these attacks depends on specific quantization schemes and model architectures, rather than just the nominal bit-width. The researchers conclude that auditing at source precision is insufficient; for secure edge AI, the final deployed configuration must be included in behavioral certification.
