Quantization Can Introduce Backdoors in Language Models

This study uncovers a critical security vulnerability in Large Language Models (LLMs) related to post-training quantization. It highlights a "validation-deployment gap" where models certified safe at full precision can exhibit malicious behavior once compressed using quantization techniques like INT8 or 4-bit. The researchers formalize this concept through Quantization Behavioral Equivalence Classes (QBECs), demonstrating that membership in these classes does not guarantee behavioral equivalence. The paper introduces a method to embed latent malicious payloads into models that pass full-precision checks but activate targeted adversarial actions post-quantization. Experiments in tactical machine translation and political content analysis showed significant behavioral shifts, such as translation inversion rates up to 85.02% and ideological bias shifts of 0.33. Crucially, the study found that these attacks can transfer across different quantization schemes and model architectures, emphasizing that auditing must extend to the final deployed, quantized configuration to ensure trustworthy edge AI.