Backdoors That Trigger Only After Quantization Confirmed by Two Research Teams

What happened

A paper posted to arXiv on 27 August 2026 formalizes what its authors call a validation-deployment gap: because quantization — compressing a model’s weights from, say, 16-bit floating point down to 8-bit or 4-bit — maps many full-precision weight values onto the same compressed value, a model that passes safety checks at full precision is not guaranteed to behave the same way once it is quantized for deployment, according to the paper. The paper, “Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation-Deployment Gap,” is authored by Jacopo Dardini (University of Bologna), Claudio Stanzione (Luiss Guido Carli), Giordano Colò (Live Tech / AI Department Rome) and Giuseppe Fenza (University of Salerno). The authors state on the preprint that the work has been accepted at ARES 2026, a security conference, though no independent listing on the conference program was found to confirm it.

The attack the authors describe does not appear spontaneously — it requires an attacker to poison the model beforehand. The paper describes a three-stage process: fine-tune the model on a malicious task, compute per-weight bounds the authors call Quantization Behavioral Equivalence Class constraints that describe which full-precision weight values all round to the same quantized value, then use projected gradient descent to push the model back toward clean, benign behavior at full precision while staying inside those bounds. The poisoned behavior only resurfaces once the model is quantized.

On translation models, the paper reports that repaired full-precision (FP16) versions showed 0.00% corrupted output, but after quantization the corruption rate rose as high as 82.27% for NLLB-200-1.3B and 85.02% for M2M100-1.2B, both using NF4 quantization. On political and stance-related content, the authors report an ideological bias shift of up to 0.33 in quantized small language models (Llama-3.2-1B, Gemma-3-1B), versus 0.00 at full precision. The paper also finds that how well a backdoor survives quantization depends heavily on the specific quantizer and architecture, not just bit-width: one model’s backdoor transferred from INT8 to NF4 at a rate of only 0.063, near collapse, while another transferred at 0.552. The authors conclude that nominal bit-width alone does not predict whether an attack survives.

The authors themselves flag several limits: all tested models were roughly 1 billion parameters, far smaller than most deployed production models; no already-released public model was audited; all results come from single runs with fixed seeds and no variance estimates; and no detection or defense method was tested. The authors also state they will not release the poisoned training artifacts, repaired checkpoints, or full datasets, citing dual-use concerns — meaning outside researchers cannot directly reproduce the 85.02% figure or the paper’s other headline numbers.

This is not the first such demonstration. A group at ETH Zurich (Kazuki Egashira, Mark Vero, Robin Staab, Jingxuan He, Martin Vechev) published “Exploiting LLM Quantization” at NeurIPS 2024, using a different implementation to show that widely used quantization methods — LLM.int8(), NF4, FP4 — “can be exploited to produce a harmful quantized LLM, even though the full-precision counterpart appears benign, potentially tricking users into deploying the malicious quantized model,” per the paper’s abstract, with public code released. The same group extended the technique to GGUF-format quantization, used by the popular llama.cpp local-inference toolchain, in a follow-up accepted at ICML 2025. Beyond these two lines of work, arXiv listings show several other independently authored papers on quantization-conditioned backdoors published between 2024 and 2026, including one accepted at the ACM Web Conference 2026 — though only their titles and venues were checked, not their full text.

What this means (and what it does not)

The demonstrated finding is that quantization is not a neutral engineering step from a security standpoint: two independent teams, working from different implementations, have each built a model that passes evaluation at full precision and misbehaves only once compressed. That undercuts a common assumption — that validating a model before quantizing it is sufficient — and does so as a recognized research direction pursued by multiple unconnected groups, not a single lab’s claim.

What it does not show is that any model currently running in production contains such a backdoor. Neither this paper nor the ETH Zurich work audited a real, already-deployed public model; both built the poisoned model themselves as a proof of concept. The attack also requires an attacker to control the training process before release, which makes it a supply-chain risk rather than something that emerges on its own when an innocently trained model is quantized. The paper’s own authors have an interest in this framing beyond the science: a novel vulnerability class with a new name and theoretical framework is valuable academic output regardless of how likely the attack is to occur outside a lab, and the venue itself — ARES 2026 and the broader AI-security research community — benefits from publicity around a striking new attack on a widely used deployment technique.

What we still do not know

Whether this backdoor exists in any model actually running in production has not been tested by either research line. Whether the corrupted behavior needs a specific secret-phrase trigger, as in classic backdoors, or shifts broadly across all inputs once quantized, is not stated explicitly in the available text. Whether the effect holds at the scale of models people actually deploy — 7 billion to 70-billion-plus parameters — is untested; all reported models were around 1 to 1.3 billion parameters. Whether a standard safety re-validation would catch the attack is unknown, since no detector or defense was evaluated; the paper’s only suggested mitigation, echoed from the earlier ETH Zurich work, is to evaluate models in the quantized form they will actually be deployed in, but that recommendation itself was not tested against this attack. The reported figures, including the 85.02% corruption rate, rest on the authors’ own single, unreplicated runs, since no checkpoints or training data were released. The ARES 2026 acceptance is confirmed only by the authors’ own preprint. And how the attack’s success trades off against detectable quality loss in a realistic review pipeline is unclear — the authors note the poisoned models already lose 5 to 6 BLEU points and 4 to 7 percentage points of MMLU accuracy, which could plausibly fail an attentive reviewer’s quality bar even without security-specific testing, but this was not checked against real acceptance thresholds.