文章背景与核心概要
随着大语言模型（LLMs）在资源受限的边缘设备上广泛部署，训练后量化（Post-training quantization）通常被认为是一种安全且语义中立的优化方法。然而，本文揭示了一个关键的安全漏洞，即“验证-部署鸿沟”。由于量化是对参数空间的多对一映射，在全精度（如 FP16）下通过认证的模型，并不能保证其压缩版本（如 INT8 或 4-bit）表现一致。作者通过“量化行为等价类（QBECs）”形式化了这一现象，在理论上证明了 QBEC 成员身份并不能确保行为等价，这为“量化触发式后门攻击”奠定了基础——模型可以通过源精度的安全检查，同时隐藏仅在压缩时才被激活的潜在恶意负载。
本文开发了一个三阶段的对抗性微调框架，成功将潜伏的恶意行为嵌入到满足源精度检查的模型中，并在 INT8 或 4-bit 压缩时触发目标对抗行为。研究人员在战术机器翻译和政治内容分析两个真实场景中评估了这一威胁，将前沿研究从纯解码器因果语言模型扩展到了多语言编码器-解码器序列到序列模型。实验结果表明，后门翻译模型在修复后的 FP16 下测量到的敌我混淆率为 0%，但在量化后反转率高达 85.02%；而成对立场分类器在压缩时则表现出高达 \(\Delta\mathrm{Bias} = 0.33\) 的意识形态偏移。这项研究表明，仅进行源精度审计无法排除量化触发的行为，为了实现值得信赖的边缘 AI，最终的部署配置必须纳入行为认证中。
Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap
Authors: Jacopo Dardini, Claudio Stanzione, Giordano Colò, Giuseppe Fenza
Published: August 27, 2026 (Accepted at ARES 2026)
Primary Subject: Machine Learning (cs.LG)
arXiv ID:2608.27512| DOI: 10.48550/arXiv.2608.27512
📌 Summary
Post-training quantization is widely considered a safe, semantically neutral optimization method for deploying Large Language Models (LLMs) on resource-constrained edge devices. However, this paper reveals a critical security vulnerability: the validation–deployment gap.
Because quantization acts as a many-to-one mapping over parameter space, certifying a model at full-precision (e.g., FP16) does not guarantee that its compressed counterpart (e.g., INT8 or 4-bit) will behave identically. The authors formalize this phenomenon through Quantization Behavioral Equivalence Classes (QBECs), proving theoretically that QBEC membership does not ensure behavioral equivalence. This forms the foundation for quantization-triggered backdoor attacks, where models pass source-precision safety checks while hiding latent malicious payloads that activate only upon compression.
🔍 Key Highlights & Findings
- Formalizing the Gap: Introduced Quantization Behavioral Equivalence Classes (QBECs) to demonstrate why source-precision audits fail to capture post-compression behaviors.
- Adversarial Framework: Developed a three-stage adversarial fine-tuning framework to embed latent malicious behaviors that remain dormant under full-precision checks but trigger upon INT8 or 4-bit compression.
- Diverse Domain Evaluation: Tested the threat across two real-world scenarios:
- Tactical Machine Translation: Backdoored models jumped from 0% friend–foe corruption at repaired FP16 to up to 85.02% inversion post-quantization.
- Political Content Analysis: A paired stance classifier exhibited a measurable ideological shift of \(\Delta\mathrm{Bias} = 0.33\) upon compression.
- Cross-Quantizer Transferability: Discovered that attack persistence varies significantly across different quantization schemes and model architectures rather than relying purely on the nominal bit-width.
📝 Abstract
Post-training quantization is often treated as a semantically neutral optimization for edge deployment of Large Language Models. When a full-precision source checkpoint is evaluated and quantization is applied downstream without equivalent re-evaluation, this workflow creates a structural validation--deployment gap: because quantization is a many-to-one mapping over parameter space, source-precision certification does not guarantee behavioral equivalence in the deployed configuration. We formalize this gap through Quantization Behavioral Equivalence Classes (QBECs) and prove that QBEC membership does not imply behavioral equivalence, providing a theoretical basis for quantization-triggered backdoor attacks. Building on a three-stage adversarial fine-tuning framework, we embed latent malicious payloads into models that satisfy the source-precision checks used in our evaluation, yet activate targeted adversarial behavior upon INT8 or 4-bit compression. We evaluate this threat in two operationally motivated scenarios, tactical machine translation and political content analysis, extending prior work from decoder-only causal LMs to multilingual encoder-decoder sequence-to-sequence models. Results show that backdoored translation models move from zero measured friend--foe corruption at repaired FP16 to up to 85.02% inversion after quantization, and that a paired stance classifier measures an ideological shift of up to \(\Delta\mathrm{Bias}=0.33\) upon compression. A cross-quantizer transferability analysis further shows that attack persistence varies across quantization schemes and model architectures, rather than being determined by nominal bit-width alone. These findings demonstrate that source-precision auditing alone does not rule out quantization-triggered behavior and that the final deployed configuration must be included in behavioral certification for trustworthy edge AI.