Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap

Jacopo Dardini; Claudio Stanzione; Giordano Colò; Giuseppe Fenza

Source-linked AI summary

Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap

Jacopo Dardini, Claudio Stanzione, Giordano Colò, Giuseppe Fenza

arXiv:2608.27512v1Aug 27, 2026cs.LGcs.AIcs.CLcs.CR

TL;DR

The paper asks whether source-precision validation can certify behavior after post-training quantization, given quantization’s many-to-one parameter mapping. It formalizes QBECs and constructs repaired models that are benign at full precision but activate targeted behavior after compression. Across tactical translation and political content analysis, the results show quantization-triggered behavior and persistence that vary by quantizer and architecture.

Problem
Source-precision certification may not establish behavioral equivalence for a model after downstream quantization, creating a validation–deployment gap.
Method
The paper formalizes QBECs and uses three-stage adversarial fine-tuning with quantizer-specific constraints and projected-gradient repair.
Results
85.02% friend-foe identification inversion and ΔBias up to 0.33 were measured after compression, while cross-quantizer persistence varied across schemes and model architectures.
Takeaways & Limitations
Behavioral certification should include the final deployed quantized configuration rather than relying only on source-precision auditing.
Takeaways & Limitations
Attack stealth has a non-zero utility cost, and cross-quantizer transferability is inconsistent across model–quantizer pairs.

Abstract

from arXiv · show

Post-training quantization is often treated as a semantically neutral optimization for edge deployment of Large Language Models. When a full-precision source checkpoint is evaluated and quantization is applied downstream without equivalent re-evaluation, this workflow creates a structural validation--deployment gap: because quantization is a many-to-one mapping over parameter space, source-precision certification does not guarantee behavioral equivalence in the deployed configuration. We formalize this gap through Quantization Behavioral Equivalence Classes (QBECs) and prove that QBEC membership does not imply behavioral equivalence, providing a theoretical basis for quantization-triggered backdoor attacks. Building on a three-stage adversarial fine-tuning framework, we embed latent malicious payloads into models that satisfy the source-precision checks used in our evaluation, yet activate targeted adversarial behavior upon INT8 or 4-bit compression. We evaluate this threat in two operationally motivated scenarios, tactical machine translation and political content analysis, extending prior work from decoder-only causal LMs to multilingual encoder-decoder sequence-to-sequence models. Results show that backdoored translation models move from zero measured friend--foe corruption at repaired FP16 to up to 85.02% inversion after quantization, and that a paired stance classifier measures an ideological shift of up to $Δ\mathrm{Bias}=0.33$ upon compression. A cross-quantizer transferability analysis further shows that attack persistence varies across quantization schemes and model architectures, rather than being determined by nominal bit-width alone. These findings demonstrate that source-precision auditing alone does not rule out quantization-triggered behavior and that the final deployed configuration must be included in behavioral certification for trustworthy edge AI.

1 Introduction

The paper identifies a validation–deployment gap in which post-training quantization can activate malicious behavior that remains dormant under source-precision checks. It formalizes this risk with QBECs and evaluates cross-architecture, deployment-relevant persistence.

Post-training quantization can trigger latent adversarial behavior after a model passes full-precision safety checks.The threat concerns downstream compression applied without equivalent re-evaluation.
QBECs formalize quantization-induced deployment mismatch, and quantization-equivalent models need not remain behaviorally equivalent.Proposition 1 provides the stated theoretical basis for this non-equivalence.
The study extends quantization-backdoor evaluation from decoder-only causal LMs to multilingual encoder-decoder sequence-to-sequence models.The evaluated models include NLLB-200-1.3B and M2M100-1.2B.
Cross-quantizer persistence depends on quantizer geometry and model family rather than nominal bit-width alone.A repair variant excluding shared embeddings and the output head increases NLLB persistence without changing measured BLEU.
85.02% friend-foe identification inversion and ΔBias up to 0.33 occur after compression despite targeted source-precision checks not revealing the behavior.These results cover tactical translation and political content analysis.

2 Related Work

Prior work established vulnerabilities from adversarial prompts, runtime-triggered sleeper agents, and quantization-triggered backdoors. This paper shifts the attack surface to the deployment transformation and extends evidence across model families.

Adversarial prompting and jailbreak optimization attack fixed deployment configurations at inference time.The paper contrasts these runtime attacks with transformation-triggered behavior.
Sleeper agents behave normally during evaluation but activate when exposed to specific runtime triggers.Quantization-triggered backdoors instead use deployment transformation as the trigger.
Quantization-triggered backdoors activate through deployment transformation without requiring prompt or runtime input modification.The behavior is not exercised by source-precision-only evaluation.
Earlier quantization-backdoor work focused on decoder-only causal LMs, whereas this paper extends evaluation to multilingual encoder-decoder models.The extension addresses a broader model family and operational setting.

3 Attack Methodology

The attack uses three stages: malicious fine-tuning, quantizer-specific QBEC construction, and projected-gradient repair on clean data. The repaired model is benign at full precision but can recover malicious behavior after quantization.

3.2 Quantization Preliminaries: Quantization maps full-precision parameters to discrete representations through a deterministic many-to-one compression operator.The many-to-one structure creates high-dimensional equivalence regions in parameter space.
3.3 Quantization Behavioral Equivalence Classes: QBEC membership means models share the same quantized representation, not the same input-output behavior.The paper states this as behavioral non-invariance and supports it with Proposition 1.
3.3 Quantization Behavioral Equivalence Classes: The security implication is that certifying one full-precision representative cannot guarantee behavior across its QBEC.The paper therefore treats post-training quantization as security-relevant rather than semantically neutral.
Stage 1: Malicious Fine-Tuning.: The adversary fine-tunes a pretrained model on systematically corrupted or biased examples to establish malicious behavior.In translation, friendly forces are rendered as hostile forces.
Stage 2: QBEC Constraints: Stage 2 computes per-weight QBEC intervals that preserve each weight’s quantized value under the chosen quantizer.The intervals differ between uniform INT8 and non-uniform NF4 schemes.
Stage 3: Projected Gradient Descent Repair.: Stage 3 applies projected gradient descent on clean data while constraining every weight within its QBEC interval.Projection restores weights to the feasible quantization-equivalent region after each update.
Stage 3: Projected Gradient Descent Repair.: The repaired model is optimized and checked at full precision, while Q(M*) = Q(Mm) restores Stage-1 malicious behavior after quantization.Coarser quantization may enlarge repair freedom, but success also depends on quantizer and model.

4 Experimental Evaluation

The evaluation applies the attack framework to tactical translation and political content analysis under deployment-relevant quantization settings. It also examines edge contexts, cross-quantizer transferability, and controlled synthetic-data limitations.

The experiments cover tactical translation, political content analysis, cross-quantizer transferability, and an embedding-channel repair variant.The latter tests when deployment mismatch suppresses or restores the attack.
Representative edge profiles contextualize why full-precision source models and INT8/NF4 deployment artifacts may differ, rather than serving as hardware benchmarks.The profiles frame the conditional attack surface studied in the paper.
The translation evaluation uses NLLB-200-1.3B and M2M100-1.2B, multilingual models supporting 200 and 100 languages respectively.Both are evaluated on operationally motivated multilingual deployment scenarios.
The study evaluates LLM.int8() dynamic 8-bit quantization and NF4 4-bit NormalFloat quantization across both use cases.These schemes represent the deployment transformations examined in the experiments.
The datasets contain synthetically generated English-Ukrainian tactical communications, chosen because public labeled tactical corpora are scarce and real operational data are sensitive.The controlled design isolates attack feasibility but limits operational realism.
The tactical trigger preserves English source text while corrupting paired Ukrainian translations by swapping ally and enemy entities.The test set contains 1,000 distinct samples generated separately from training data.

Evaluation Metrics.

The evaluation uses BLEU to check retained translation quality and IFF-CSR to detect targeted friend–foe corruption, comparing full-precision and quantized behavior. BLEU is treated as a coarse stealth proxy rather than a comprehensive security audit.

Translation quality: BLEU measures n-gram overlap on FLORES-200 and checks whether repaired full-precision translation quality remains competitive.Higher overlap indicates closer agreement with reference translations.
Targeted corruption: IFF-CSR measures the percentage of friend–foe identification terms successfully corrupted after quantization.It targets operationally critical entity errors that aggregate translation quality may not reveal.
Attack signature: A successful attack combines low FP16 IFF-CSR, high post-quantization IFF-CSR, and limited BLEU degradation.The metric pairing tests whether targeted corruption can coexist with apparently acceptable translation quality.
Metric limitation: BLEU is only a coarse operational quality signal and does not constitute a comprehensive security audit.Semantic consistency checks, entity-sensitive evaluation, or direct FP16–quantized output comparisons could detect attacks that preserve aggregate quality.

Threat Scenario.

The political content-analysis scenario evaluates whether quantization preserves task competence while changing ideological framing. It uses paired full-precision and quantized outputs, with a stance classifier measuring directional shifts and explicit proxy limitations.

Threat Scenario: The setup uses Llama-3.2-1B and Gemma-3-1B to summarize political content for edge-suitable analysis.Inputs include political news, policy passages, and social media discussions.
Threat Scenario: The malicious right-wing PoliTune subset is used for Stage-1 fine-tuning, while the opposing left-wing subset supports Stage-3 repair.Repair suppresses the targeted patterns at full precision while preserving them in the quantized representation.
Evaluation Metrics: MMLU measures retained competence across five political and legal knowledge-and-reasoning subtasks.The selected subtasks provide a coarse check that the attack does not simply destroy general political or legal competence.
Evaluation Metrics: ΔBias measures the difference between average stance-classifier scores for quantized and FP16 outputs.Positive values indicate a shift toward the attack direction, using identical prompts and decoding parameters across configurations.
Evaluation Metrics: The stance classifier is a comparative proxy and does not establish absolute political neutrality or eliminate classifier-specific bias.Paired comparisons reduce some calibration concerns but leave this measurement limitation.

Evaluation Procedure.

The evaluation measures political bias under FP16 and compressed configurations, and assesses cross-quantizer persistence using transfer ratios and a neutral-point correction. Results show that measured ideological shifts and transferability vary across quantizers, models, and attack directions.

Table 4 reports MMLU performance and ideological bias measurements under quantization.
0.33: Llama’s measured ∆Bias reaches 0.33 under NF4, compared with 0.29 under INT8.Gemma reaches ∆Bias values of 0.22 and 0.24 under INT8 and NF4, respectively.
FP16 ∆Bias is zero by definition because it is the reference configuration, not because neutrality was independently established.
The transferability analysis evaluates INT8-optimized attacks under INT8, INT4, NF4, and FP4 deployment quantizers.
The Transfer Consistency Ratio measures the fraction of attack strength retained when the optimization and deployment quantizers differ.
The neutral-point-corrected score prevents negative persistence when likelihood ratios cross neutrality, with ε = 10^-8 preventing division by zero.
46.33%: NLLB retains 46.33% IFF-CSR under NF4 from an 83.99% INT8 attack, while INT4 and FP4 each retain only 5.12%.For M2M100, strong on-diagonal performance coexists with collapse under all 4-bit schemes, demonstrating architecture-dependent transferability.
Under corrected persistence, NF4 transfer is zero for both Llama and Gemma, while Gemma retains 0.079 under INT4 and FP4.

4.5 Mechanism-Grounded Ablation: Embedding-Excluded Repair

The ablation excludes shared embeddings and the output head from constraint construction and repair to test how repair scope affects quantization-induced drift. For NLLB, this sharply increases NF4 persistence without changing measured BLEU, while the effect is weak for M2M100.

The repair variant excludes shared embeddings and the output head from Stage-2 constraint construction and Stage-3 repair, while leaving Stage-1 malicious fine-tuning unchanged.
The analysis compares malicious, repaired FP16, and deployed quantized parameter vectors through repair displacement and deployment drift.
71.75%: Excluding the selected channels raises NLLB’s NF4 IFF-CSR from 46.33% to 71.75%, with TNF4 increasing from 0.552 to 0.860.Measured BLEU remains unchanged on the neutral benchmark.
39.8%: The exclusion reduces NLLB’s all-parameter repair norm from 9.92 to 5.97 and raises ρNF4 from 36.45 to 60.55.The absolute NF4 displacement remains approximately unchanged, so the larger ratio is driven by the smaller repair denominator.
For M2M100, NF4 persistence rises only from 0.063 to 0.083, showing that the ablation effect is architecture-dependent.
The findings indicate that selective repair is not inherently conservative: excluding channels can increase cross-quantizer persistence for some architectures.

5 Operational Implications for Military Systems

The paper frames quantization-triggered backdoors as an operational integrity risk for defence-relevant AI workflows, while distinguishing controlled experiments from measurements on live military systems. The main implication is that source-only validation can miss deployment-specific behavioral shifts.

The operational discussion addresses strategic and tactical implications, but the experiments are operationally motivated rather than conducted on live military systems.
Publicly hosted open-source models are used for defence-relevant tasks, creating a supply-chain context for compromised model artifacts.
0.33: Quantized political-analysis models show a measured directional shift up to ∆Bias = 0.33 relative to repaired FP16, while source-only evaluation cannot measure that shift.The FP16 reference value of ∆Bias = 0.00 does not independently establish neutrality.
85.02%: Translation models reach up to 85.02% IFF-CSR after quantization while maintaining zero measured corruption at full precision.This demonstrates controlled feasibility for resource-constrained deployment settings, not prevalence or detectability in live DDIL operations.
Quantization-triggered backdoors can corrupt observations in the OODA loop through targeted post-deployment activation rather than random errors.
Behavioral equivalence between validated and deployed models is presented as a condition for sustained human-AI collaboration in operational settings.
Detection and mitigation directions are discussed as addressing both strategic and tactical dimensions of the identified risk.

6 Discussion and Future Directions

The discussion identifies practical limits on quantization-triggered backdoors, including utility costs, limited transferability, controlled evaluation conditions, and restricted reproducibility. It recommends deployment-aware certification and outlines detection, hardening, and future research directions.

Attack Limitations and Scalability: 5–6 BLEU points and 4–7 percentage points of MMLU degradation create a non-zero stealth cost that stricter acceptance thresholds could detect.
Attack Limitations and Scalability: T = 0.552 for NLLB INT8 → NF4 versus T = 0.063 for M2M100 INT8 → NF4 shows that transferability depends on model–quantizer pairs.
Attack Limitations and Scalability: Synthetic tactical corpora may amplify lexical regularities, so IFF-CSR results indicate vulnerability under controlled conditions rather than direct live-pipeline performance.
Attack Limitations and Scalability: Single fixed-seed runs without repeated experiments or confidence intervals mean the reported point estimates are not statistically stable measurements.
Attack Limitations and Scalability: The evaluation covers approximately 1B-parameter models, leaving behavior of quantization-triggered backdoors at substantially larger scales unresolved.
Mitigation Directions: Differential testing, multi-quantizer validation, embedding-channel monitoring, and quantization-aware adversarial training are proposed, with effectiveness and broader scope remaining open questions.
Mitigation Directions: Behavioral certification should include the exact final quantized artifact, because full-precision auditing alone may provide a misleading sense of safety.
Reproducibility and Artifact Availability: The full attack artifacts and datasets will not be released because functional quantization-triggered backdoors pose dual-use and misuse concerns.

7 Conclusions

The conclusions establish that quantization can separate source-precision validation from deployed behavior, enabling backdoors that remain hidden before compression. Across controlled evaluations, persistence varies by quantizer and architecture, motivating certification of the final deployed configuration.

QBEC membership does not imply behavioral equivalence, allowing backdoors to remain dormant under source-precision checks and activate upon compression.
Empirical evaluation across two operationally motivated domains establishes quantization-triggered backdoor feasibility under controlled conditions.
Cross-quantizer analysis shows that equal nominal bit-width does not imply equal persistence, and the weak M2M100 ablation effect demonstrates architecture dependence.
Full-precision auditing alone cannot rule out these attacks when the compressed artifact is not tested under equivalent criteria.
Behavioral certification should target the final deployed configuration, using QBEC analysis and cross-quantizer testing as starting points for compressed-LLM certification pipelines.

Appendix

The appendix gives a constructive proof that models sharing a quantized representation can produce different outputs. Under small decision margins, this within-class variation can cross a classification boundary without changing quantized weights.

A fixed quantizer creates QBEC regions containing full-precision parameter vectors that collapse to the same compressed representation.
Continuity and non-constant logit variation along a positive-width QBEC interval produce two models with different outputs on an input.
The constructed models quantize identically, satisfying Q(W (1)) = Q(W (2)) while their input-output functions differ.
When a clean decision margin is smaller than the achievable within-class output variation, the construction can flip the predicted label while preserving quantized weights.