PaperlayerView exact revision on arXiv

Source-linked AI summary

Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compression

Junyuan Hong, Jinhao Duan, Chenhui Zhang, Zhangheng Li, Chulin Xie, Kelsey Lieberman, James Diffenderfer, Brian Bartoldson, Ajay Jaiswal, Kaidi Xu, Bhavya Kailkhura, Dan Hendrycks, Dawn Song, Zhangyang Wang, Bo Li

arXiv:2403.15447v3cs.CLcs.AI

TL;DR

Compression can improve LLM efficiency while affecting trustworthiness in ways that benign metrics alone may miss. This paper evaluates three LLMs compressed with five methods across eight trustworthiness dimensions and finds that quantization generally offers a better efficiency–trust trade-off than pruning, while extreme compression is risky.

  • Problem

    Existing evaluations largely emphasize benign task performance, leaving the safety and trustworthiness effects of compressing LLMs insufficiently understood.

    Source: §1 · p. 1

  • Method

    The paper evaluates three 13b LLMs compressed with five state-of-the-art methods across eight trustworthiness dimensions, utility, and refusal rates.

    Source: §1 · p. 2, §3 · p. 4

  • Results

    Quantization generally preserves trustworthiness more effectively than pruning and can improve selected trustworthiness dimensions while retaining efficiency.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The findings support comprehensive trustworthiness testing when selecting compression methods and rates for efficient LLM deployment.

    Source: §1 · p. 2, §7 · p. 9

    Trustworthiness trade-offs across dimensions mean efficient models should be selected by carefully balancing metrics rather than optimizing one dimension alone.

    Source: §6 · p. 9

Abstract

from arXiv · show

Compressing high-capability Large Language Models (LLMs) has emerged as a favored strategy for resource-efficient inferences. While state-of-the-art (SoTA) compression methods boast impressive advancements in preserving benign task performance, the potential risks of compression in terms of safety and trustworthiness have been largely neglected. This study conducts the first, thorough evaluation of three (3) leading LLMs using five (5) SoTA compression techniques across eight (8) trustworthiness dimensions. Our experiments highlight the intricate interplay between compression and trustworthiness, revealing some interesting patterns. We find that quantization is currently a more effective approach than pruning in achieving efficiency and trustworthiness simultaneously. For instance, a 4-bit quantized model retains the trustworthiness of its original counterpart, but model pruning significantly degrades trustworthiness, even at 50% sparsity. Moreover, employing quantization within a moderate bit range could unexpectedly improve certain trustworthiness dimensions such as ethics and fairness. Conversely, extreme quantization to very low bit levels (3 bits) tends to reduce trustworthiness significantly. This increased risk cannot be uncovered by looking at benign performance alone, in turn, mandating comprehensive trustworthiness evaluation in practice. These findings culminate in practical recommendations for simultaneously achieving high utility, efficiency, and trustworthiness in LLMs. Code and models are available at https://decoding-comp-trust.github.io.

1. Introduction

This paper addresses the unclear effects of compression on LLM trustworthiness by evaluating compressed models across diverse trust dimensions and utility. It finds that compression method and rate produce distinct trustworthiness trade-offs, with quantization generally more favorable than pruning and extreme quantization especially risky.

Motivation and scope

  • The study evaluates compressed LLMs across eight trustworthiness dimensions alongside multi-task utility, addressing limitations of evaluations focused mainly on benign performance.The trust dimensions include stereotype, toxicity, privacy, fairness, ethics, and several robustness measures.Source: §1 · p. 2

Main findings

  • Pruning produces inferior and inconsistent outcomes in both utility and trustworthiness compared with quantization.This comparison is part of the paper’s analysis of routes to 7b-sized models.Source: §1 · p. 2
  • Quantization can preserve or improve trustworthiness while maintaining efficiency, suggesting a favorable joint trade-off between utility, efficiency, and trust.The paper reports that quantization improves certain trustworthiness dimensions at low overhead.Source: §1 · p. 2
  • Extreme 3-bit quantization significantly decreases multiple trust dimensions even when benign performance does not show the same decline.This exposes risks that benign evaluation alone can miss.Source: §1 · p. 2

Implications

  • The paper summarizes practical guidance for compressing LLMs while accounting for hidden trustworthiness costs rather than relying on efficiency or benign performance alone.The recommendations are presented as a bag of tricks for efficient and trustworthy LLMs.Source: §1 · pp. 1–2

2. Related Works

Prior work has developed scalable compression methods and evaluated compressed models mainly through benign utility metrics. However, systematic evidence about how compression affects trustworthiness remains limited, motivating comprehensive evaluation of compressed LLMs.

Compression methods

  • LLM compression research includes quantization, pruning, low-rank approximation, and knowledge distillation, with weight quantization and semi-structured pruning especially scalable without extra training.These methods target efficient inference on pretrained models.Source: §2 · p. 3
  • Quantization methods reduce precision from 8 bits to 3, 4, or even 2 bits, while preserving salient weights or using lattice-based techniques to limit accuracy loss.The related work describes LLM.INT8(), GPTQ, AWQ, QuIP, and QuIP#.Source: §2 · p. 3
  • Pruning removes parameters, but limited retraining and the risk of deleting important weights make calibration-based and structured strategies necessary.SparseGPT and Wanda are examples of calibration-based methods discussed in the paper.Source: §2 · p. 3

Evaluation of compressed LLMs

  • Compressed models are commonly evaluated using perplexity, classification, question answering, reasoning, and knowledge metrics, which can make 4-bit quantization appear comparable to dense models.Recent work also reports that quantization can outperform pruning on tested benign tasks at similar compression rates.Source: §2 · p. 3

Research gap

  • Existing evaluations provide limited systematic evidence about trust-related costs, despite trustworthiness being important for deployment and potentially changing with model scale and compression.The paper identifies compressed trust as an unresolved area requiring in-depth investigation.Source: §2 · p. 3

3. Assessing the Trustworthiness of Compressed LLMs

The study evaluates compressed versions of three 13b LLMs using quantization and pruning methods across utility, eight trustworthiness dimensions, and refusal rates. Its design compares compression strategies, model types, and trust-related outcomes under varied compression settings.

Evaluation goals

  • The evaluation asks which compression method and rate best balance multi-dimensional trustworthiness with standard performance, including the effects of extreme 3-bit quantization.These questions organize the assessment of compressed LLMs.Source: §3 · p. 3

Models

  • Three 13b models—LLAMA2, LLAMA2 Chat, and Vicuna Chat—provide diverse pretrained and instruction-tuned bases for assessing compression effects.Their differing trustworthiness strengths motivate their inclusion.Source: §3 · p. 4

Compression methods

  • The study compares two quantization methods and three pruning methods, focusing on training-free, data-free techniques and hardware-relevant N:M sparsity.The pruning methods are SparseGPT, Wanda, and magnitude pruning; the quantization methods are GPTQ and AWQ.Source: §3 · p. 4

Evaluation dimensions

  • Performance is measured with MMLU, while trustworthiness uses eight DecodingTrust dimensions covering stereotype, privacy, toxicity, fairness, adversarial robustness, OOD robustness, adversarial demonstrations, and ethics.Refusal rates are also reported as complementary behavioral information.Source: §3 · pp. 4–5

Comparison setup and findings

  • At a 50% compression rate, quantization appears to preserve trustworthiness and benign performance with minimal loss relative to dense models.Figure 2 compares relative score differences against 13b baselines and marks refusal-rate changes.Source: Figure 2 · p. 5

4. Revisiting Paths to 7B-sized LLMs: Training Smaller, or Compressing Larger?

The study compares pre-trained 7b models with 7b-sized models compressed from 13b models, finding that trustworthiness varies across dimensions and that quantization generally preserves the larger model’s profile better than pruning.

4. Revisiting Paths to 7B-sized LLMs: Training Smaller, or Compressing Larger?

  • The study compares pre-training a 7b model from scratch with compressing an approximately 13b model to obtain similar computation and storage complexity.Compression may retain language performance, but its trustworthiness effects at high compression rates remain insufficiently evaluated.Source: §4 · p. 5

Pre-trained 7b LLMs

  • Across LLAMA2, LLAMA2 Chat, and Vicuna, 7b models show at least three dimensions favoring them over 13b models, although disparities are larger and more variable for non-aligned LLAMA2.The observed variance suggests alignment may matter for resilience to down-scaling.Source: §4 · p. 5

Compressed 7b-sized LLMs

  • Quantizing 13b models to 8-bit causes less than 3-point drops across all metrics, whereas pruning loses over 5 points on at least three dimensions.The comparison supports quantization as the more consistent route to 7b-sized models, while pruning results vary across models and dimensions.Source: §4 · p. 6

Pre-trained 7b LLMs

  • 7b models outperform their 13b counterparts in 3–4 trust dimensions by over 5 points, with Fairness consistently favoring the smaller models.LLAMA2 Chat is significantly better in inference robustness and Fairness, while 13b models remain stronger on MMLU, Adv Demo, and Ethics.Source: §4 · pp. 5–6

5. From Moderate to High Compression Rates: The (Unexpected) Gains and Losses

The experiments identify 4-bit quantization as a practical efficiency–trustworthiness sweet spot, while 3-bit compression can create severe trust failures that benign performance alone does not reveal.

5.1. Finding the Essential Compression Rates and Induced Gains for Trustworthiness

  • 4-bit quantization preserves trustworthiness within a 5-point drop across perspectives and offers a sweet spot for efficiency, utility, and trustworthiness.Compared with LLAMA2 7b, 4-bit quantized 13b models are more accurate on language understanding and stronger on several trust dimensions.Source: §5.1 · p. 6, §5.2 · p. 8
  • 4-bit quantization improves Ethics from 54.1 to 76.3 with GPTQ or 62.8 with AWQ, and can outperform the dense model by over 5 points in Ethics and Fairness.These gains are not universal across sub-scenarios and often occur where the dense model performs poorly.Source: §5.1 · p. 7
  • In the Ethics Evasive scenario, 4-bit quantization lowers FPR and refusal rates, whereas the enhancement disappears at 3 bits.The authors attribute the gain to activated knowledge of immoral actions rather than hallucination.Source: §5.1 · p. 7, Figure 4 · p. 7, Figure 5 · p. 7
  • In few-shot Fairness settings, GPTQ quantization reduces EOD by over 0.2 at 16 shots, while 4-bit models improve fairness without increasing refusal rates.The 8-bit model’s fairness improvement is linked to refusal rates above 50%, making it ineffective for the prediction task.Source: §5.1 · p. 7, Figure 6 · p. 7

5.2. The Losses on the Extreme Compression Rate

  • At 3 bits, AWQ remains within a 5-point drop on seven trust dimensions but fails substantially on Adv Demo and Fairness, showing risks hidden by benign MMLU performance.GPTQ is worse in several dimensions, with approximately 30-point OOD and 50-point Toxicity drops; its failures are associated with lost instruction-following ability.Source: §5.2 · p. 8
  • AWQ is safer than GPTQ at extreme compression, but 3-bit models still show metric trade-offs and no seed wins across all metrics.Figure 7 reports relative differences across three seeds and their averages and standard deviations.Source: §5.2 · p. 8, Figure 7 · p. 8

6. Bag of Tricks for Trustworthy Compression

The paper recommends quantization over pruning for reliable trust preservation, starting from a trustworthy dense model and evaluating highly compressed models across trust dimensions before deployment.

6. Bag of Tricks for Trustworthy Compression

  • Quantization is more reliable than pruning for obtaining compressed LLMs with trustworthiness similar to the source model at the same compression rate.Both methods can improve efficiency, but their trustworthiness outcomes differ in consistency.Source: §6 · p. 8
  • Because 4/8-bit quantization approximately restores the source model’s trustworthiness, compressed models largely inherit the strengths and weaknesses of their dense starting model.The paper therefore recommends choosing a trustworthy dense model before compression.Source: §6 · p. 8
  • Random calibration can produce over-5-point variance at 4-bit and variance as large as 15 at 3-bit, so highly compressed models require comprehensive trustworthiness evaluation.This variance is not predictable from standard MMLU performance alone.Source: §6 · p. 8
  • 3-bit AWQ models exhibit trade-offs among trust dimensions, such that higher OOD scores can coincide with substantially worse Stereotype scores.Model selection should therefore consider trade-offs across trust dimensions rather than a single metric.Source: §6 · p. 9

7. Conclusion

The study reveals complex interactions between compression efficiency and trustworthiness, while quantization can enhance selected dimensions at minimal cost. It provides guidance for developing efficient yet trustworthy language models.

  • Compression affects trustworthiness differently across dimensions, requiring nuanced evaluation of efficiency–trustworthiness trade-offs.The study emphasizes that quantization may enhance specific trustworthiness dimensions at minimal cost.Source: §7 · p. 9
  • The released models and modified benchmark support reproducibility of the compression and trustworthiness experiments.The materials address score variance caused by large refusal rates.Source: §7 · p. 9

Impact Statement

Efficient LLM deployment creates trustworthiness risks that existing evaluations do not comprehensively address. The paper situates its benchmark within prior trustworthiness work and emphasizes systematic joint evaluation of efficiency and trustworthiness.

Impact Statement

  • Compressed LLMs can introduce biases, privacy leakage, and toxic generation despite reducing computational costs and broadening accessibility.The impact statement calls for ongoing ethical scrutiny and adaptive measures.Source: Impact Statement · p. 9

A. Additional Related Works

  • Existing trustworthiness benchmarks cover dimensions including toxicity, stereotype, robustness, privacy, machine ethics, fairness, and truthfulness.DecodingTrust provides a comprehensive eight-perspective design, while later benchmarks extend or specialize these evaluations.Source: A. Additional Related Works · p. 13
  • Joint consideration of compression efficiency and trustworthiness remains missing in prior work.The paper presents its benchmark as a comprehensive assessment combining MMLU with three trustworthy dimensions relative to other papers in Table 2.Source: A. Additional Related Works · p. 13

B. Additional Experimental Results

Additional experiments examine evaluation assumptions, dense-model differences, quantization behavior, high compression, instruction following, and model-size effects. Across these analyses, trust outcomes vary by model, compression method, bit level, and dimension.

B. Additional Experimental Results

  • Fairness and Ethics metrics are modified to include refusal responses, treating refusal as a fair failure or a negative ethics response.This adjustment addresses bias from varying refusal rates and reduced sample sets.Source: B. Additional Experimental Results · p. 13
  • Quantization can improve fairness or AdvGLUE++ while generally degrading other trust dimensions, with AWQ and GPTQ showing different patterns.AWQ preserves salient weights, whereas GPTQ may distort out-of-distribution features through calibration-set reconstruction.Source: B. Additional Experimental Results · pp. 13–14, Figure 9 · p. 14
  • LLAMA2 Chat, LLAMA2, and Vicuna have similar MMLU performance but distinct trustworthiness strengths and weaknesses.LLAMA2 Chat benefits from alignment and RLHF, while Vicuna improves Privacy and Adv Demo but worsens other perspectives relative to relevant baselines.Source: B. Additional Experimental Results · p. 14, Figure 8 · p. 14
  • High-compression analyses compare LLAMA2 13b and Vicuna 13b at 3, 4, and 8 bits, with lower-bit effects becoming less consistent than dense models.The figures report standard deviations for fewer-bit settings and mark score drops over 5 points.Source: B. Additional Experimental Results · p. 14, Figure 10 · p. 15, Figure 11 · p. 15
  • Instruction-following ability drops sharply at 3-bit compression, and the associated OOD robustness is significantly biased.The evaluation tests GPTQ-quantized Vicuna-13b and LLAMA2-Chat-13b at 3, 4, and 8 bits using MT-Bench.Source: B. Additional Experimental Results · pp. 14–15
  • For 7b source models, OOD, Ethics, and Fairness drop by over 5 points while MMLU drops only 1.6 points, so benign performance misses trust risks.The authors conjecture that lower redundancy in 7b models makes quantization more damaging.Source: B. Additional Experimental Results · p. 15

C. Detailed Breakdown Results of DecodingTrust Benchamark

  • The study reports all sub-scenarios across AdvGLUE++, Adv Demo, OOD robustness, Fairness, Ethics, Privacy, Stereotype, and Toxicity.Each sub-scenario includes a main metric and, where applicable, a refusal rate.Source: C. Detailed Breakdown Results of… · p. 15

C.1. AdvGLUE++

The detailed benchmark evaluates adversarial-text, adversarial-demonstration, and out-of-distribution robustness under compression. AWQ generally preserves robustness better than GPTQ, although aggressive quantization can degrade specific capabilities while sometimes improving SST-2 robustness.

C.1. AdvGLUE++

  • AdvGLUE++ measures accuracy on adversarially perturbed SST-2, QQP, and MNLI examples generated with five word-level perturbations.The benchmark evaluates whether target LLMs correctly answer adversarial examples.Source: §C.1 · pp. 15–16
  • AWQ matches dense performance on MNLI and QQP and improves SST-2 adversarial robustness by nearly 10% at 3 bits.GPTQ remains similar at 8 bits but degrades substantially under more aggressive compression.Source: §C.1 · p. 16, Figure 12 · p. 16

C.2. Adversarial Demonstration

  • AWQ produces comparable adversarial-demonstration robustness to dense models, whereas GPTQ substantially degrades robustness, especially at low bit rates.Three-bit quantization marginally hurts performance across scenarios, while robustness to spurious correlation and backdoors declines as bits decrease.Source: §C.2 · pp. 16–17
  • Compression may improve robustness to counterfactual adversarial demonstrations.The adversarial-demonstration evaluation also covers spurious correlations and backdoors under varied demonstration settings.Source: §C.2 · pp. 16–17

C.3. Out-of-Distribution (OOD)

  • OOD evaluation covers transformed input styles, unknown knowledge, and OOD demonstrations, including few-shot settings.Knowledge questions use RealtimeQA events from 2020 to 2023.Source: §C.3 · p. 17
  • Quantization generally hurts OOD robustness, especially for unknown knowledge, while AWQ is more stable than GPTQ and in-context learning can recover input-style performance.The LLAMA2 13b Chat knowledge-task result is unreliable because its base evaluation performance is broken by response truncation.Source: §C.3 · p. 17

C.4. Fairness

Fairness evaluation shows that compression effects depend on demographic configuration, prompting regime, and quantization method. Machine-ethics results likewise vary by task and bit level, with moderate compression sometimes preserving or improving performance while extreme compression can degrade it.

C.4. Fairness

  • Imbalanced sensitive-attribute distributions deteriorate compressed models’ equalized-odds fairness scores.Source: §C.4 · p. 17
  • Few-shot quantized models are normally fairer than the dense model because they achieve higher refusal rates than in zero-shot evaluation.Source: §C.4 · p. 17
  • GPTQ models remain closer to the dense model in fairness, while AWQ and GPTQ behave oppositely across zero-shot and few-shot settings.Source: §C.4 · pp. 17–18

C.5. Machine Ethics

  • 4-bit quantization yields the best evasive-evaluation performance, while 3-bit quantization significantly harms immoral-action detection under jailbreaking.Source: §C.5 · p. 18
  • Quantization worsens zero-shot machine ethics, but few-shot demonstrations can compensate; AWQ is generally more stable and better than GPTQ.Source: §C.5 · p. 18
  • Medium compression preserves evasive detection, whereas extreme 3-bit quantization tends to mitigate jailbreaking but significantly degrades capabilities in other ethics settings.Source: §C.5 · p. 18

C.6. Privacy

Privacy results show that compression changes leakage and refusal behavior in task-dependent ways. Stereotype effects are limited in adversarial prompt settings but increase in ordinary benign interactions.

C.6. Privacy

  • 3-bit and 4-bit quantization produce larger privacy-leakage rates than the dense model in general.Source: §C.6 · p. 19
  • AWQ with fewer bits causes about 10% more personally identifiable-information leakage but better privacy-sensitive word and event recognition, whereas GPTQ shows the opposite trend.Source: §C.6 · p. 19
  • Quantized models preserve private training data as well as the dense model in most situations, so privacy risk requires case-dependent evaluation.Source: §C.6 · p. 19
  • Lower refusal rates have task-dependent privacy implications: they coincide with lower leakage for GPTQ in PII tasks but higher leakage in understanding tasks.Source: §C.6 · p. 19

C.7. Stereotype

  • Quantization significantly increases bias in benign stereotype tasks but does not significantly change bias in untargeted or targeted tasks.Source: §C.7 · p. 22
  • Malicious system prompts induce rejection of biased statements, explaining the apparent robustness of untargeted and targeted stereotype results.Source: §C.7 · p. 22

C.8. Toxicity

Toxicity evaluation compares toxic outputs and refusal behavior across prompt types and system instructions. Extreme 3-bit compression is associated with low refusal and substantially higher toxicity, while prompt-specific bypasses expose additional weaknesses.

C.8. Toxicity

  • 3-bit models show very high toxicity because their refusal rates are very low.Source: §C.8 · p. 22
  • Adversarial jailbreaking system instructions generally fail to induce toxic output because they produce high rejection rates, although toxicity rises for non-toxic user prompts.Source: §C.8 · p. 22
  • Prompts designed to bypass GPT-3.5 and GPT-4 policies achieve lower rejection rates than general toxic prompts under benign system instructions.Source: §C.8 · p. 22
  • GPTQ 3-bit quantization lowers rejection of toxic prompts and significantly reduces toxicity resistance in almost all settings.Source: §C.8 · p. 22
Loading 2403.15447v3…