mlsanityData to 14 Oct 2026

Quality Is Not a Safety Proxy Under Quantization

arXiv 2606.10154 ↗First posted 8 Jun 2026cs.LG cs.CRcited by 1

Not on the map. Why?

Abstract (arXiv)

Quantized checkpoints are often screened first with quality metrics and only later, if at all, with direct safety tests. This paper audits that shortcut on a matched 51-row matrix spanning 6 models, 4 families, a 7-level GGUF ladder, and AWQ/GPTQ INT4 checkpoints. In this matrix the shortcut fails: all 36 quality-safety pairings split direction across models, and 9 hidden-danger rows plus 1 near-hidden-danger row show quality stable or improved while refusal falls by 12-68 percentage points. Seven of the 11 AWQ/GPTQ rows are hidden-danger. A four-probe mechanistic follow-up over the 17 Hugging Face-backed FP16/AWQ/GPTQ cells does not rescue it: entropy, refusal-direction, and calibration probes are weak or null separators of dangerous rows, and although probe-identified safety-associated neurons absorb 1.39× more quantization error overall (p < 5 × 10-7), the effect is not regime-specific. Claude Sonnet 4 relabels 11,470 items in a predefined stratified set, agrees with the primary gemma3:12b judge on 89.9% of rows (kappa = 0.873, 95% CI [0.866, 0.881]), and changes 0/10 hidden-danger cells. A calibrated study-internal behavioral screen -- the Refusal Template Stability Index (RTSI), built from four refusal-template drift features and calibrated on this matrix -- routes 10/10 hidden- or near-hidden-danger rows to direct safety testing (Wilson 95% CI lower bound 0.72) while leaving 23 of 45 non-baseline rows in a low-risk bucket under both in-sample scoring and row-level leave-one-out validation; on the same matrix, the best single-feature baselines (unique-prefix-rate-delta, raw refusal-rate delta) recover 9/10 and 8/10 respectively at matched bucket size, and cross-stack transfer requires recalibration. For the quantized checkpoints, model families, and safety outcomes studied here, retained quality cannot waive direct safety evaluation.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 36 of its 46 references that are in the map. First posted on arXiv 8 Jun 2026.

Builds on

36 of 46 references.

References · 36

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  2. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  3. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
  4. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,886
  5. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  7. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  8. 2022GPTQ: Accurate Post-Training Quantization for Generative Pre-trained Transformerscited by 1,919
  9. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  10. 2022SmoothQuant: Accurate and Efficient Post-Training Quantization for Large Language Modelscited by 1,386
  11. 2023AWQ: Activation-aware Weight Quantization for LLM Compression and Accelerationcited by 1,298
  12. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
24 more
  1. 2024Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluatorscited by 897
  2. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  3. 2023AlpacaFarm: A Simulation Framework for Methods that Learn from Human Feedbackcited by 748
  4. 2021BBQ: A Hand-Built Bias Benchmark for Question Answeringcited by 701
  5. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  6. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  7. 2023A Survey on Model Compression for Large Language Modelscited by 269
  8. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 231
  9. 2024Scaling Laws for Precisioncited by 95
  10. 2024Exploiting LLM Quantizationcited by 65
  11. 2024Safetywashing: Do AI Safety Benchmarks Actually Measure Safety Progress?cited by 61
  12. 2024Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compressioncited by 57
  13. 2025Measurement to Meaning: A Validity-Centered Framework for AI Evaluationcited by 57
  14. 2024Beyond Perplexity: Multi-dimensional Safety Evaluation of LLM Compressioncited by 33
  15. 2025Reliable and Efficient Amortized Model-based Evaluationcited by 31
  16. 2022Spurious Correlations in Reference-Free Evaluation of Text Generationcited by 26
  17. 2024Holistic Safety and Responsibility Evaluations of Advanced AI Modelscited by 19
  18. 2025Investigating the Impact of Quantization Methods on the Safety and Reliability of Large Language Modelscited by 18
  19. 2025How Post-Training Reshapes LLMs: A Mechanistic View on Knowledge, Truthfulness, Refusal, and Confidencecited by 12
  20. 2024More RLHF, More Trust? On The Impact of Preference Alignment On Trustworthinesscited by 9
  21. 2025Towards Understanding and Improving Refusal in Compressed Models via Mechanistic Interpretabilitycited by 7
  22. 2024When Quantization Affects Confidence of Large Language Models?cited by 5
  23. 2026Q-realign: Piggybacking Realignment on Quantization for Safe and Efficient LLM Deploymentcited by 5
  24. 2025Safety-Preserving PTQ via Contrastive Alignment Losscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Cosine Similarity Is Not Evidence: Measuring the Noise Floor of Interpretability Transfer Under Quantizationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026The Joint Effect of Quantization and Sampling Temperature on LLM Safety Alignment: A Factorial Analysis
  2. 2026Flat Score, Amplified Failures: How the Error Budget Masks Damage in Quantized LLM Agents
  3. 2026The Effect of Quantization on Clinical Benchmarks: Accuracy and Safety Across Model Families
  4. 2026The Structure of Quantization Damage in LLMs: Why the Next Bit Should Be Spent Globally
  5. 2025Assessing the Potential for Catastrophic Failure in Dynamic Post-Training Quantization
  6. 2026The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators
  7. 2025Optimizing Deep Neural Networks using Safety-Guided Self Compression
  8. 2026Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Families