PaperlayerView exact revision on arXiv

Source-linked AI summary

Not All 4-bit Quantizers Are Equal: Deployment-Time Mitigation of PII Leakage in Fine-Tuned Small Language Models

Cristhian Kapelinski, Diego Kreutz

arXiv:2609.25014v1cs.CRcs.AIcs.LG

TL;DR

Whether 4-bit quantization changes extraction of PII memorized during fine-tuning was not established by prior comparisons focused on unlearning. The paper compares calibration-based and calibration-free quantizers across fine-tuned small models and finds lower extraction with calibration-based methods, motivating quantizer choice as part of privacy evaluation.

  • Problem

    Whether the 4-bit method changes extraction of PII memorized during fresh fine-tuning was untested, despite quantization following private-data fine-tuning.

    Source: §I · pp. 1–2

  • Method

    The study compares calibration-based AWQ and GPTQ with calibration-free GGUF quantization across fine-tuned small models at matched effective bit-rates.

    Source: §I · p. 2, §III · p. 4

  • Results

    On the primary model, AWQ and GPTQ each yield 0% extraction versus 5.3% for Q4_K_M; AWQ leaks least in every measured cell.

    Source: §IV · p. 5, §X · p. 10

  • Takeaways & Limitations

    The authors conclude that quantizer selection belongs in privacy evaluation of deployed small language models, not only in speed and quality decisions.

    Source: §I · p. 2, §X · p. 10

    Because experiments use Enron email and email-style canaries, their measured rates do not establish effects for customer records or clinical notes.

    Source: §X · p. 10

Abstract

from arXiv · show

Organizations fine-tune small language models on private data and then compress them to 4 bits for resource-efficient deployment. We show that the compression method also affects privacy. What separates the methods is not the bit width but whether they tune their rounding on a small sample of text, the calibration corpus. On our primary model, when each planted record's own opening text is used as the prompt, the two calibration-based methods we test, Activation-aware Weight Quantization (AWQ) and Gradient-based Post-Training Quantization (GPTQ), each reproduce none of the planted records, while the calibration-corpus-free GGUF Q4_K_M format reproduces 5.3% of them. Tracked across five open models with 0.5-7 billion parameters, AWQ leaks least at every size and in both families, with little accuracy loss at 3-7 billion. Controlled experiments associate the difference with calibration-induced rounding error in channels involved in rare-token prediction. Choosing the 4-bit method is therefore a deployment-time privacy decision, not only a question of speed and quality.

I. INTRODUCTION

The introduction frames 4-bit quantization as a deployment choice that can alter how much fine-tuned PII is exposed, even when inference stays on-premise. It positions the study as a fixed-bit comparison of calibration-based and calibration-free methods on fresh fine-tunes.

Deployment setting

  • On-premise small-model deployment can keep prompts and inference inside an organization, but does not remove information memorized during training.The described pipeline fine-tunes on internal data that may contain PII, then applies 4-bit quantization to reduce memory and hardware requirements.Source: §I · p. 1

Quantization methods

  • Calibration-based AWQ uses calibration text to scale high-response channels before rounding, while GGUF Q4_K_M rounds blocks based on their weights alone.AWQ shifts rounding error toward channels left idle by the calibration text.Source: §I · p. 1

Prior evidence

  • Prior work links memorization to capacity, duplication, and prompt length, and reports that fine-tuning choices can shift leakage risk.Examples include differences between updating the last layer, the whole network, or adding LoRA adapters.Source: §I · p. 2

Privacy motivation

  • Verbatim extraction is the primary threat because it reveals a memorized record and requires only a text-in/text-out interface; membership inference is complementary.Reproduced personal data also raises data-subject rights concerns under the LGPD and GDPR.Source: §I · p. 2

Research question

  • The study asks whether quantization method changes extraction of PII memorized during fresh fine-tuning, comparing methods at a fixed 4-bit budget.The authors position this as the first such comparison on a verbatim PII benchmark at this scale.Source: §I · p. 2

II. RELATED WORK

Related work measures memorization and studies quantization–privacy interactions, but the authors identify a gap: prior studies do not combine PII targets with comparisons among 4-bit methods.

Quantization × privacy

  • Studies targeting PII do not vary quantization methods, while studies varying methods examine unlearned content rather than fresh fine-tunes.The closest prior comparison found no method-specific difference after machine unlearning, where quantization must preserve a small weight change.Source: §II · pp. 2–3

Memorization measurement

  • Canary exposure ranks planted records against template-matching strings, while exact extraction, probabilistic extraction, membership, and adversarial-compression measures use different success criteria.Exact-match metrics can miss paraphrases, motivating an embedding-similarity measure alongside them.Source: §II · p. 2
  • Prior work varies training-side mechanisms such as duplication and fine-tuning regime while leaving post-training compression fixed.The cited work also reports unchanged canary exposure at 8-bit quantization, a result the paper says its Q8_0 cell reproduces.Source: §II · p. 2

Quantization characterization

  • GPTQ uses calibration text to quantize one layer at a time and adjust unrounded weights to offset error, whereas GGUF k-quants require no calibration corpus.Q4_K_M is estimated at 4.7 bits per parameter, while default AWQ is roughly 4.25 bits per parameter.Source: §II · p. 3

III. THREAT MODEL AND METHODOLOGY

The methodology evaluates black-box extraction and membership inference across open small language models, fine-tuning regimes, and quantization formats. It uses planted email canaries, matched prompts and decoding rules, and utility measures on in-domain and out-of-domain text.

Threat model

  • The primary threat model is a black-box user who submits prefixes and reads completions, with no access to weights, gradients, or training data.The primary evaluation allows at most six completions per target; membership inference requires a stronger interface that returns per-token probabilities.Source: §III · pp. 3–4

Models

  • The study evaluates five open-weight models from 0.5B to 7B parameters under full fine-tuning and LoRA, with seed counts varying by model and regime.The primary Llama-3.2-1B model uses five seeds; the 3B and 7B full-fine-tuning cells use one seed each.Source: §III · p. 4

Canaries, corpus, and fine-tuning

  • Each seed includes 100 synthetic email canaries planted at four duplication levels, mixed into 3,000 Enron emails; held-out Wikipedia and synthetic OOD sequences serve as non-members.The canaries contain fictitious high-entropy fields, and the corpus therefore contains no real personal data.Source: §III · p. 4

Quantization methods

  • The method space includes GGUF k-quants, AWQ, and GPTQ, with AWQ and GPTQ calibrated on the same 128 Enron passages.AWQ group-size settings vary effective bit-rate, allowing comparisons at matched bit-rate rather than nominal format labels.Source: §III · p. 4

Metrics

  • Verbatim extraction counts a record when greedy continuation from its opening prompt reproduces at least 10 characters of the true suffix.Robustness checks use sampled completions and 5- or 20-character thresholds; semantic similarity also counts generations with cosine similarity of at least 0.8.Source: §III · p. 4

Membership inference and utility

  • Membership inference uses Min-K% and Min-K%++ on canaries and non-members, while utility is measured by perplexity ratios and zero-shot benchmark accuracy.Non-members include out-of-distribution synthetic text and held-out Enron emails; utility benchmarks include ARC-easy, HellaSwag, and WinoGrande.Source: §III · p. 5

IV. QUANTIZATION METHOD AND VERBATIM PII EXTRACTION

AWQ has the lowest or tied-lowest greedy extraction rate across the measured cells, with a 4–23 percentage-point advantage over Q4_K_M. Results across seeds and additional checks show the gap is not confined to one run or prompt setting.

IV. QUANTIZATION METHOD AND VERBATIM PII EXTRACTION

  • On the primary 1B model, AWQ extracts 0/100 canaries in all five seeds, including a seed in which BF16 extracts only 21/100, and never exceeds Q4_K_M in any of the eight cells or either model family.On the five-seed primary 1B model, the AWQ versus Q4_K_M pairwise Fisher exact test with Benjamini–Hochberg correction gives pBH ≈2.2 × 10−6.Source: §IV · p. 5
  • 4–23 percentage points: AWQ's advantage over Q4_K_M; AWQ never exceeds it in eight cells, and both 4-bit methods reach 0% under LoRA.Table III reports greedy-≥10-char extraction rates as a percentage of canaries.Source: §IV · p. 5, Table III · p. 6
  • Mean cosine similarity falls from 0.74 under Q4_K_M to 0.43 under AWQ, while outputs above 0.8 fall from 33 to 1.The gap persists across duplication levels and match thresholds from 5 to 20 characters.Source: §IV · p. 6
  • In a single-seed stress test with up to 100 sampled completions per target, BF16 extracts 30 of 100 canaries while AWQ extracts no more than 1.The passage reports that extra queries do not remove the difference.Source: §IV · p. 6

V. MECHANISM: ROUNDING GRANULARITY, NOT SALIENCY

The experiments distinguish calibration-based rounding from bit rate alone and test whether calibration content explains the extraction difference. They associate calibration with rounding errors in rare-token directions and token changes at memorized positions.

V. MECHANISM: ROUNDING GRANULARITY, NOT SALIENCY

  • Across six GGUF variants, extraction rises monotonically with effective bit rate; its cliff is ∼4.5–5 bpw, versus 0% extraction for AWQ and GPTQ at ∼4.25 bpw.The boundary is shifted ∼0.3–0.5 bpw toward higher precision for calibration-based methods.Source: §V · p. 6
  • At ∼4.5 bpw, AWQ-g64 extracts 0/100 canaries while Q4_K_M extracts 6/100, showing a gap at matched bit rate.AWQ-g32 extracts 4/100 at ∼5.0 bpw, while Q5_K_M extracts 25/100 at ∼5.5 bpw on the same seed.Source: §V · p. 6
  • GPTQ extracts 0/100 canaries in all three seeds, while Q4_K_M has a 5.3% extraction rate; their different rounding algorithms both use calibration data.This supports calibration as the distinguishing axis here, but does not isolate calibration from every implementation difference.Source: Table IV · p. 6, §V · p. 6
  • Changing AWQ's calibration distribution leaves all four cells at 0/100 extraction for both the ≥10-character threshold and any-of-6 decoding.The passage attributes ≥5-character counts of 0, 3, 1, and 2 to tokenization-boundary noise; adding canary content does not change the result.Source: §V · p. 6
  • Calibration makes rarely exercised channels coarsely quantized: AWQ scales them before rounding, while GPTQ under-corrects them, enlarging error in rare-token directions.The proposed factors require the fresh fine-tuning change |δ| to be comparable to or larger than ∆, the distance between adjacent 4-bit values; minimal-change unlearning does not meet that condition.Source: §V · p. 7
  • Controls reject update erasure, harder canary reconstruction, extreme activations, and backend mismatch as explanations for the extraction difference.GPTQ retains a median per-weight update-survival ratio of 1.02; canary reconstruction error is 0.50–0.99× ordinary-text error, and canary activations are 1.16× more peaked.Source: §V · p. 7
  • At RECALL, cos(d, ev⋆) is 0.0094 for AWQ and 0.0064 for Q4_K_M, versus 0.0028 for same-size noise; held-out Enron text gives 0.0017–0.0018.The passage says the error is aimed at the memorized token and that this aiming is specific to memorized content.Source: Table V · p. 7, §V · p. 7
  • At RECALL, token flips are 78% under AWQ versus 48% under Q4_K_M; at BODY they are 0% and 0.3%, disrupting canary suffixes without visibly degrading ordinary generation.A canary is extracted only when every token of its suffix survives.Source: §V · p. 7

VI. THREAT-MODEL SPLIT: RECONCILING WITH PRIOR WORK

Membership-inference results depend on whether non-members are out-of-distribution or held out from the same corpus. The in-distribution protocol leaves neither Min-K% nor LiRA with usable membership signal, despite AWQ’s collapse of verbatim extraction.

Threat measures

  • AWQ’s Min-K% AUC stays at 0.97 under OOD non-members even as verbatim extraction falls from 30% to 0%.Canaries’ mean log-probability shifts from −0.03 to −6.12, but OOD non-members remain lower at about −9.15; held-out Enron is higher at −3.49.Source: §VI · p. 8

In-distribution non-member control

  • Against Enron non-members, AWQ’s Min-K%, Min-K%++, and loss AUCs are 0.22, 0.19, and 0.49, versus BF16’s 0.83, 0.78, and 0.86.Against OOD non-members, AWQ reaches 0.97, 1.00, and 0.99, while BF16 reaches 1.00 on all three scores.Source: §VI · p. 8
  • In-distribution AWQ AUCs of 0.19–0.49 fall below chance because canary suffixes score below fresh Enron suffixes; flipping the rule recovers only AUC 0.78.The reported +36% rare-token noise amplification is associated with this inversion.Source: §VI · p. 8

LiRA

  • Under the in-distribution protocol, both BF16 and AWQ have LiRA TPR = 0 on all three score functions and the inverted rule.With OOD non-members, BF16 reaches 1.00 and AWQ 0.83–1.00, so the protocol difference comes from the non-member set.Source: §VI · p. 8

Reconciliation

  • The prior post-unlearning comparison’s lack of a method gap is consistent with these results: it used a different training regime and excluded calibration-corpus-free GGUF.A 1B replication of that setting produced ROUGE-L scores of 0.06 for BF16 and GGUF and 0.09 for AWQ.Source: §VI · p. 8

VII. UTILITY COST

AWQ’s utility cost varies by task and model scale. Its perplexity overhead declines at larger sizes, but the supplied results do not establish that it dominates Q4_K_M on both utility and privacy axes at 3B or 7B.

Downstream task accuracy

  • AWQ scores 67.76, 45.59, and 62.12 on ARC-easy, HellaSwag, and WinoGrande, versus BF16’s 67.55, 47.76, and 61.40.The respective deltas are +0.21, −2.17, and +0.72 percentage points; the single mean (−0.41 pp) masks HellaSwag’s decline.Source: §VII · p. 8

Perplexity across scale

  • At 7B, AWQ’s perplexity ratios are 1.002 in-domain and 1.044 out-of-domain; the in-domain ratio is 1.022 at 3B.At 1B, AWQ’s ratios are 1.123 in-domain and 1.094 on WikiText; calibration content changes utility by less than 0.5%.Source: §VII · p. 8
  • Q4_K_M perplexity was not measured at 3B or 7B, so AWQ’s small absolute cost there does not establish two-axis dominance over Q4_K_M.Perplexity ratios compare quantized models against BF16, with 1.0 representing no overhead.Source: §VII · pp. 8–9

VIII. REGIME NUANCES ACROSS SCALE AND FAMILY

AWQ’s extraction advantage varies with model scale and fine-tuning regime. It is largest in one small Qwen model, disappears under standard rank-16 LoRA, and remains under full fine-tuning as it attenuates with scale.

Cross-family results at small scale

  • On Qwen2.5-0.5B, AWQ extraction is 0.0% versus Q4_K_M’s 23.0%; at 1.5B the rates are 5.0% and 13.7%.The Qwen results use Adafactor, so the method-specific gap is not confined to the primary model’s AdamW optimizer.Source: §VIII · p. 9

LoRA

  • At all three rank-16 LoRA scales, both 4-bit methods extract 0.0%, while BF16 extracts 23–28%.LoRA’s per-parameter update is approximately 1.6×10^-4, versus 3.6–9.0×10^-4 for full fine-tuning; a tenfold 3B LoRA learning-rate increase restores a gap, with AWQ at 7% and Q4_K_M at 25%.Source: §VIII · p. 9

Scale and operational guidance

  • Under full fine-tuning, AWQ leakage rises from 0.0% to 3.0% to 6.0% across 1B, 3B, and 7B, while Q4_K_M rises from 4.0% to 16.0% to 24.0%.At 7B, fixed-size calibration covers a smaller fraction of activation space; the section also flags an unresolved Llama-3.2-3B BODY FLIP anomaly.Source: §VIII · p. 9

Operational guidance

  • For small fully fine-tuned models (≤1.5B), AWQ reaches 0% except on Qwen2.5-1.5B, which retains 5%; at 3–7B it leads Q4_K_M by 13–18 pp for a 0.2–2% perplexity cost.Under LoRA, both 4-bit methods reach 0%, while serving the merged BF16 checkpoint restores 23–28% leakage.Source: §VIII · p. 9

IX. REAL PII VS. SYNTHETIC CANARIES

The paper pairs planted canaries with matched natural-frequency PII mined from Enron emails. AWQ’s low member-versus-non-member gap transfers to this real-PII control, while synthetic canaries remain an upper bound on practical leakage.

Natural-canary control

  • The natural-canary targets occur at most three times in training and have left contexts occurring only once, to keep completions verifiable.The targets are email addresses, phone numbers, street addresses, or dollar amounts.Source: §IX · p. 9

Real PII results

  • For real Enron PII, AWQ’s member-versus-non-member gap is at most 1 pp at both 3B and 7B, while Q5_K_M and BF16 retain a +5 pp gap at 7B.At 7B, Q4_K_M’s gap is +1 pp despite 24% synthetic-canary leakage; both 4-bit methods suppress natural-frequency PII at that scale.Source: §IX · p. 9
  • BF16 leaks 30% of synthetic canaries but only 5–10% of real Enron PII, supporting the synthetic protocol as an upper bound.The natural-canary control uses 100 mined targets per pool with member and non-member pools matched by PII type.Source: §IX · p. 9

X. LIMITATIONS AND CONCLUSION

The conclusion attributes leakage differences to calibration rather than bit width: AWQ and GPTQ reach zero extraction on the primary model, while Q4_K_M leaves 5.3%. AWQ has lower verbatim extraction than Q4_K_M across full-fine-tuning cells, but remains one control among several and does not protect the BF16 checkpoint.

Conclusion

  • AWQ acts on deployed weights without retraining and complements other defenses, but it neither protects the BF16 checkpoint nor provides a formal guarantee.The paper positions it alongside differential privacy, deduplication, LoRA, and serve-time filters.Source: §X · p. 9

Limitations

  • The measured rates come from Enron email and email-style canaries, so they do not establish effects for customer records or clinical notes.The conclusion calls for evaluating additional data domains.Source: §X · p. 10
  • The 3B and 7B full-fine-tuning results use one seed rather than five, 7B LoRA is unevaluated, and the 3B BODY anomaly remains unexplained.These constraints limit the generality of the proposed mechanism.Source: §X · p. 10
  • Serving the BF16 checkpoint restores leakage, while adaptive extraction, model stealing, side channels, and other listed attacks lie outside the threat model.The authors also identify multi-seed 3B and 7B runs and models beyond 7B as future evaluation needs.Source: §X · p. 10

Conclusion

  • 0% of planted records are extracted with AWQ and GPTQ, versus 5.3% with Q4_K_M on the primary model; AWQ is lower in every full-fine-tuning cell across five models and two families.The comparison uses each planted record’s own opening text as the prompt.Source: §X · p. 10
  • Controlled experiments associate calibration-amplified rounding error in rare-token prediction channels with suppressed memorized strings and largely intact general predictions.The difference depends on regime: both 4-bit methods suppress extraction under standard LoRA, and only a larger LoRA update restores their difference.Source: §X · p. 10
Loading 2609.25014v1…