PaperlayerView exact revision on arXiv

Source-linked AI summary

Broken on Arrival: Silently Defective LLM Artifacts in Public Model Registries and How to Catch Them

Aditi Patodiya

arXiv:2609.05881v1cs.SEcs.LG

TL;DR

Public registries distribute quantized LLM artifacts without functional tests, and the prevalence of silent defects had not been established. The authors execute a census with calibrated smoke testing and adjudication, confirming five official defects and backend-dependent failures among community conversions.

  • Problem

    Public registries distribute quantized LLM artifacts without functional testing, and how common silent defects are had not been established.

    Source: §I · p. 1

  • Method

    The study audits official and community artifacts with a calibrated smoke suite, then adjudicates suspects against baselines, another backend, and independent conversions.

    Source: A. Sampling frame · p. 3, C. Measurement protocol · p. 3, §VII · p. 6

  • Results

    5 of 305 official artifacts (1.6%) were defective, and two community conversions failed on one backend while passing on another.

    Source: A. RQ1: how many artifacts are… · p. 4, §VII · p. 6

  • Takeaways & Limitations

    The findings support an inexpensive registry acceptance test, like the checks standard in package registries.

    Source: §VII · p. 6

    The smoke suite tests Python code generation only, so defects in other uses and subtler quality degradation can escape it.

    Source: §VI · p. 6

Abstract

from arXiv · show

Developers increasingly run large language models locally by pulling quantized GGUF artifacts from public registries, yet nothing in the distribution pipeline functionally tests these conversions before they reach users. We executed 327 quantized code-capable model artifacts: 305 from the official Ollama library, spanning 15 model lines at every eligible quantization level at or under 8 GB, and 22 from the most-downloaded community repositories on HuggingFace. Each ran a 15-task smoke suite calibrated so that healthy artifacts pass while a known-broken one fails; suspects then faced full 164-task evaluation, a second inference backend, an independent distributor's conversion of the same model and quantization as referee, and, for community files, re-testing under the artifact's own template. The official library carries five silently defective artifacts, a batch of four Qwen2.5-Coder-3B conversions and one phi3.5-mini conversion, that solve zero of 164 tasks and zero of the smoke suite on both backends while independent conversions of the same models work: 1.6% of official artifacts, 2 of 29 model-and-size conversion groups. The adjudication chain cleared small-model artifacts that a naive threshold would condemn as broken when they are merely collapsed by extreme quantization, and it exposed two older community conversions that degrade badly on CUDA yet pass on Metal: not defective files but backend-dependent failures, a third phenomenon no registry currently tests for. Two confirmed defects produce output whose surface statistics sit inside the healthy range, invisible to any low-noise heuristic short of execution. We release the audit dataset, the quantcheck acceptance-testing tool, and disclosure reports for every confirmed defect (https://github.com/aditi-p31/quantcheck), and argue that model registries need the acceptance gate that package registries already run.

I. Introduction

The paper asks how common silently defective distributed artifacts are, a question prior work had not established. It answers with a functional census and a multi-stage process for distinguishing broken conversions from model or precision limitations.

I. Introduction

  • Before this study, how common silently defective artifacts were had not been established.Prior work described related failures, including a pre-tokenization defect that propagated into curated registries,.Source: §I · p. 1
  • The census executes 327 quantized code-capable artifacts: 305 from the official Ollama library and 22 from popular HuggingFace community repositories.The official artifacts cover 15 model lines at or under 8 GB.Source: §I · p. 1
  • A calibrated 15-task smoke suite separates healthy configurations from a known defect, while suspects must also fail 164 tasks, a second backend, and an independent conversion comparison.On ground truth from 24 configurations, every healthy one passed all 15 tasks and the known-defective artifact passed none.Source: §I · p. 1
  • The adjudication distinguishes genuine distribution defects from capability collapse at low precision and backend-dependent failures.The paper also reports that one defect class produces statistically normal output, so surface statistics cannot substitute for execution.Source: §I · pp. 1–2
  • The authors release the quantcheck acceptance-testing tool, the audit dataset with transcripts, and disclosure reports for confirmed defects.Source: §I · p. 2

A. The quantized artifact supply chain

The paper describes a multi-actor pipeline that brings quantized models to local users, with GGUF conversions forming the dominant last mile. Prior work addresses quantization and malicious artifacts, but accidental conversion errors remain unmeasured.

A. The quantized artifact supply chain

B. Trust and quality on model hubs

Research on model hubs documents metadata and performance discrepancies but does not execute distributed artifacts. Work on package registries offers a precedent: registry-side checks and continuous integration are standard safeguards, and this study adapts that measurement and remedy to model artifacts.

B. Trust and quality on model hubs

  • Model-hub studies report missing attributes, mismatches between claimed and actual performance, misleading provenance signals, and many unmaintained uploads, but do not execute artifacts.Registries measure downloads and uploads rather than whether artifacts behave as claimed.Source: B. Trust and quality on model hubs · p. 2

C. Package registries had this problem first

  • Package-supply-chain research catalogued 107 attack vectors [21], examined weak links across 1.63M npm packages [22], and found unguarded registries deliver bad artifacts to users [23].Source: C. Package registries had this problem… · p. 2
  • Registry-side checks and continuous integration became standard for code packages; this study transposes ecosystem-scale measurement and publication-time acceptance tests to model artifacts.The proposed acceptance test is described as inexpensive.Source: C. Package registries had this problem… · p. 2

D. Quantization failures and testing ML artifacts

Prior quantization and testing research establishes the value of small behavioral tests, but has not measured defects in user-downloaded conversions at ecosystem scale. This study defines an official and community sampling frame and calibrates a smoke suite against healthy and defective configurations.

D. Quantization failures and testing ML artifacts

  • Prior work studies quantization behavior and testing methods, but no prior work had executed distributed quantized artifacts at ecosystem scale to measure silent breakage.The closest work profiles quantized models for efficiency or evaluates formats on researcher-controlled conversions.Source: D. Quantization failures and testing… · p. 2

A. Sampling frame

  • The official census covers 305 eligible instruct, code-capable Ollama artifacts across 15 model lines; the community set contains 22 representative files from popular HuggingFace repositories.The inventory was frozen and pull dates recorded before testing.Source: A. Sampling frame · pp. 2–3

B. A calibrated functional smoke suite

  • The 15-task suite uses tasks solved by every healthy calibration configuration; all 24 healthy configurations passed, while the known-defective artifact passed none.The suite was calibrated on Qwen2.5-Coder and prospectively tested on twelve other model families.Source: B. A calibrated functional smoke suite · p. 3

C. Measurement protocol

The protocol tests artifacts on two backends and adjudicates suspects using full evaluation and independent conversions. Confirmed defects receive reproducible disclosure reports.

C. Measurement protocol

  • Every confirmed defect is replicated on CUDA and Metal; disagreements are classified as backend-dependent failures, with findings limited to the pinned Ollama release.The pinned runtime is v0.32.6; defects specific to other runtime versions are out of scope.Source: C. Measurement protocol · p. 3
  • Suspects are checked against an independent conversion, and a random sample of unflagged artifacts is tested on held-out tasks to measure what the screen misses.A defect requires a score at or under 2 of 15 while the referee reaches at least 5 of 15 and exceeds it by at least 4 tasks.Source: C. Measurement protocol · p. 3

D. Defect handling

  • Each confirmed defect receives a disclosure report with reproduction instructions and transcripts, and registry issues are filed with affected distributors.Links to the reports are added to the released dataset as they go live.Source: D. Defect handling · p. 3

IV. Results

The census confirms five defective official-library artifacts, while cross-distributor and full-task checks distinguish conversion defects from weak or compressed models. The defects cluster in one Qwen conversion batch and one isolated phi3.5 artifact.

A. RQ1: how many artifacts are silently defective

  • 5 of 305 official artifacts (1.6%) are defective, spanning 2 of 29 model-and-size conversion groups (6.9%).The artifact-rate Wilson interval is 0.7% to 3.8%; the batch structure means artifact counts overstate independent failures.Source: Table II · p. 4, A. RQ1: how many artifacts are… · p. 4
  • The four Qwen2.5-Coder-3B artifacts solve 0 of 164 tasks, while independent same-or-nearest-level conversions solve 8 to 14 of 15 smoke tasks.The separate phi3.5-mini q2_K artifact also solves 0 of 164, versus 6 of 15 for an independent q2_K conversion.Source: A. RQ1: how many artifacts are… · pp. 3–4, Table II · p. 4
  • The two llama3.2-1B low-bit suspects are capability collapse, because independent conversions at the same levels also score near zero.The 2- and 3-bit conversions score 0 and 3 of 15, respectively; the cross-distributor referee separates this from a distribution defect.Source: A. RQ1: how many artifacts are… · p. 4
  • Figure 1 separates conversion defects from gradual low-precision capability collapse and a weak model that scores near the floor even at fp16.The Qwen2.5-Coder-3B row returns to full health at 4-bit, while the phi3.5:3.8b q2_K cell is an isolated zero.Source: Figure 1 · p. 4

B. RQ2: what defects look like, and whether cheap signals catch them

Defects produce several output signatures, but cheap output statistics detect only some without unacceptable false positives. Two confirmed artifacts resemble healthy outputs closely enough that execution remains necessary.

B. RQ2: what defects look like, and whether cheap signals catch them

  • The best low-noise rule catches 3 of 5 defects at a 2.3% false-positive rate, using truncation at or above 0.3 or repetition share at or above 0.3.Truncation alone catches 2 of 5 with 11 false positives; repeated-6-gram share alone catches 3 of 5 with 4 false positives.Source: B. RQ2: what defects look like, and… · p. 4
  • Confirmed defects include token-cap runaway, loops of short non-code fragments, and fluent prompt repetition without a function body.Prompt-echo fraction and missing-function-definition rate do not catch an additional defect before firing on most healthy chatty models.Source: B. RQ2: what defects look like, and… · p. 4
  • These cases had healthy repetition share and were at or below the 3rd percentile on every other signal; any threshold catching them also fires on at least 6% of healthy artifacts.Source: B. RQ2: what defects look like, and… · p. 5

C. RQ3: channels, and a backend surprise

All five confirmed defects are in the official library, while two community files show backend-dependent failures rather than failures across inference stacks. The same files perform very differently on CUDA and Metal.

C. RQ3: channels, and a backend surprise

  • The two sampled TheBloke deepseek-coder-6.7B files score 5 and 6 of 15 on CUDA but 13 and 15 of 15 on Metal.Ollama’s conversion of the identical model and quantization scores 13 of 15 on CUDA; the files therefore fail on one stack, not everywhere.Source: C. RQ3: channels, and a backend surprise · p. 5
  • The two community files omit prompt templates; using the native-template fallback on CUDA yields token-cap runs in 87% and 94% of generations.In that condition the files score 6 and 4 of 15, or 22 and 16 of 164 tasks; no prompting choice rescues CUDA.Source: C. RQ3: channels, and a backend surprise · p. 5
  • The cause of the backend difference is unresolved; the authors leave open whether one backend tolerates nonconforming files.The comparison shows that the same file, runtime version, and prompt can yield different results across backend hardware.Source: C. RQ3: channels, and a backend surprise · p. 5

D. RQ4: does the fifteen-task screen hold up

The 15-task screen flagged every artifact later confirmed defective, while adjudication resolved its false alarms on weak small models. A day-zero check also found community conversions that could not be loaded in the pinned runtime.

D. RQ4: does the fifteen-task screen hold up

  • Every artifact confirmed defective by the full 164-task evaluation had been flagged by the 15-task screen; its false alarms were weak small models resolved through adjudication.The second stage used family-relative evaluation and, in the hardest cases, an independent distributor's conversion.Source: D. RQ4: does the fifteen-task screen… · p. 5
  • 0 of 10 unflagged artifacts in the random sample resembled confirmed defects, but the estimated miss-rate interval remained 0%–27.8%.All ten solved 22%–59% of 49 held-out tasks, with a median of 44%; screening took a median 30 seconds per artifact, excluding download time.Source: D. RQ4: does the fifteen-task screen… · p. 5

E. A day-zero vignette

  • Four of five attempted community conversions of a newly released 30B model failed to parse in the pinned runtime, an observed runtime-support gap rather than a defect count.The fifth conversion could not be retrieved.Source: E. A day-zero vignette · p. 5

V. Discussion

The discussion argues for functional testing at publication and for practitioners to test artifacts on their deployment stack. It also emphasizes that output statistics cannot replace execution for detecting fluent-but-wrong defects.

For registries

  • A registry running fifteen easy tasks before publication would have caught every defect found, at a cost of seconds to minutes of commodity GPU time per artifact.The paper compares this acceptance gate with heavier publication-time checks in package registries [21], [22].Source: §V · p. 5

For practitioners

  • Practitioners should test downloaded artifacts on their deployment stack: two community files were healthy on Metal but crippled on CUDA, and fluency did not reveal the most deceptive defects.Low-bit variants of small models merit particular attention because capability collapse and conversion defects can occupy the same score range.Source: §V · p. 5

For evaluation research

  • The discussion calls for scrutiny of the distribution layer comparable to that already given to the training layer.It presents execution-based acceptance testing as an approach that can be reproduced or extended using the released materials.Source: §V · pp. 5–6
  • Output statistics miss the fluent-but-wrong defect class and over-flag healthy models; the paper identifies execution as the reliable discriminator.The discussion says calibrated, compressed suites make per-artifact acceptance testing light enough to run at ecosystem scale.Source: §V · p. 6

VI. Threats to Validity

The conclusion reports five confirmed silent defects and two backend-dependent community failures, while the validity discussion limits what the census can establish. The paper releases quantcheck, the audit dataset, and defect reports.

VI. Threats to Validity

  • The Python-code smoke suite cannot reveal defects limited to other uses, so the reported prevalence is a lower bound on functional defects overall.The census covers one registry's code-capable instruct artifacts at or under 8 GB plus a small popularity-weighted community sample; all runs use one pinned llama.cpp-based runtime.Source: §VI · p. 6

VII. Conclusion

  • Five silent defects were confirmed in the official library, while two community conversions failed on one backend and passed on another.The census covered 327 artifacts across 15 registry model lines and two distribution channels; the dual-backend rule prevented those two files from being counted as defective.Source: §VII · p. 6
  • The authors release quantcheck, the full audit dataset with transcripts, and reports filed for every confirmed defect.The paper presents these materials as resources to reproduce or extend the census.Source: §VII · p. 6, §VI · p. 6
Loading 2609.05881v1…