Audit at the Precision You Deploy: Quantization Reshapes a Subliminally Learned Preference

Md Rayhanul Masud; Mst Suraiya Akter Shefa

cs.CLOct 31, 2026

Audit at the Precision You Deploy: Quantization Reshapes a Subliminally Learned Preference

Authors: Md Rayhanul Masud, Mst Suraiya Akter Shefa

Organizations: University of California, Riverside

Abstract

Subliminal learning allows AI models to inherit hidden preferences from seemingly unrelated training data, such as number sequences. Safety audits may evaluate models at standard 16-bit precision, while deployments may use compressed, quantized weights. We ask whether quantization changes the expression of a subliminal preference and what drives any resulting change. To investigate, we implant a "favourite animal: panda" preference into Qwen2.5-7B-Instruct. We define its net strength as the difference in mean panda-answer probability between subliminal models and neutrally trained controls under the same quantization setting. Applying this metric across different compression levels reveals a stark contrast. While behaviour remains stable at 8 bits, 4-bit quantization triggers severe, opposing shifts depending on the quantizer. Half-Quadratic Quantization (HQQ) amplifies the preference, raising the subliminally trained model's panda probability from roughly 55% at 16 bits to 64% at 4 bits, while the controls stay near 17%. This raises the trait's net strength ~1.3 times its 16-bit value. In contrast, NormalFloat (NF4) at 4-bit suppresses it, shrinking the net strength to just ~0.3 times its 16-bit value, despite producing rounding errors of the same size to within 4%. We examine the structure of the rounding errors and find that their arrangement drives the divergence. Randomly shuffling HQQ's errors within each quantization group, without changing their magnitude, shifts the trait's net strength between 0.2 and 1.6 times its 16-bit value. Despite these opposing shifts, the underlying fine-tuning signal remains largely intact. Because a model's internal state and outward behaviour diverge so unpredictably under compression, a 16-bit audit cannot reliably bound real-world risks. Safety evaluations must test the exact quantized weights intended for deployment.

Figures & tables

Fig. 1: Overview. Left: A 16-bit audit of a Qwen2.5-7B-Instruct student, fine-tuned on a panda-loving teacher’s number sequences that never mention pandas, finds a “favourite animal: panda” preference at 55% against 17% for a neutrally trained control; this gap, normalized, defines the baseline net strength

R=1

. Middle: Deploying these exact same weights at 4 bits using two quantizers with identical targeted layers, group sizes, and error magnitudes moves the preference in opposite directions:

R\approx 1.3

under HQQ and

R\approx 0.3

under NF4. In contrast, an explicitly trained student of matched strength remains stable at

R\approx 1

. Right: Both quantizers preserve more than 99% of the fine-tuning delta. The quantized weights are nearly identical, yet the resulting behaviours are a factor of four apart; the 16-bit measurement bounds neither.

Fig. 2: Experimental pipeline. (1) Three types of students are trained using the same LoRA recipe: subliminal students on a panda teacher’s number sequences, neutral controls on a standard teacher’s number sequences, and explicit students on the panda teacher’s ordinary text. (2) Merged weights are quantized using HQQ (at 8, 4, 3, and 2 bits) and NF4 (at 4 bits), recording the layer-wise rounding error

E=Q(W)-W

. (3) HQQ’s 4-bit error is then applied unchanged, negated, shuffled within groups of 64 weights, or replaced by size-matched Gaussian noise (heatmaps are schematic). (4) Final evaluations measure outward behaviour via the control-adjusted panda probability relative to 16 bits (Eq. ( 1 )), and internal stability by tracking how much of the fine-tuning delta and installed activation direction survive.

Reference
Condition	Bits	Transformer layers	Output layer	Purpose
bf16 reference	16	bf16	bf16	Baseline for all normalized measurements
Quantization: precision sweep and layer ablations
HQQ full	8, 4, 3, 2	HQQ	HQQ	Precision sweep; identifies the 4-bit transition
HQQ transformer layers only	4, 3, 2	HQQ	bf16	Layer ablation; matched comparison with NF4
HQQ output layer only	4, 3, 2	bf16	HQQ	Isolates the effect of output-layer quantization

TABLE I: Evaluation conditions. Transformer layers are the 196 linear layers in the 28 transformer blocks; the output layer maps hidden states to token scores. All quantizers use groups of 64 weights. Unless noted, conditions are tested on the base model, both controls, and both subliminal students. Explicit students are tested under bf16, full HQQ at 8 and 4 bits, transformer layers-only HQQ at 4 bits, NF4, and negated and shuffled errors.

Fig. 3: Panda probability under HQQ (full configuration) from 16 down to 2 bits, for the base, both controls and both subliminal students. Shaded: the base is degraded on the task (3 bits) or broken (2 bits). Only 8 and 4 bits are clean measurements of the preference.

Students	Condition	$P_{\mathrm{ctrl}}$	$P_{\mathrm{student}}$	$R$
subliminal	bf16	17.3	53.1 / 55.8	1.00 / 1.00
	HQQ 8-bit	17.1	56.5 / 56.9	1.10 / 1.03
	HQQ 4-bit	16.9	60.9 / 66.9	1.23 / 1.30
	NF4 4-bit	18.1	27.9 / 29.5	0.27 / 0.30
explicit,	bf16	17.3	50.8 / 51.2	1.00 / 1.00
matched	HQQ 8-bit	17.1	51.6 / 52.1	1.03 / 1.03

TABLE II: HQQ and NF4 comparison, with 8-bit HQQ as a reference.

P

is panda probability (%);

R

is net strength relative to 16 bits. Paired values denote seeds 41 and 42. The 4-bit HQQ rows quantize the transformer layers only. At 4 bits, HQQ amplifies the subliminal preference, while NF4 suppresses it.

Bits	Layers quantized	$P_{\mathrm{base}}$	$P_{\mathrm{ctrl}}$	$P_{\mathrm{student}}$	Base
3	all (full)	2.9	2.0	12.7 / 7.6	degraded
3	transformer layers	4.0	2.7	16.2 / 10.7	degraded
3	output layer only	16.8	17.4	41.3 / 42.0	intact
2	all (full)	0.0	0.0	0.0 / 0.0	broken
2	transformer layers	0.0	0.0	0.0 / 0.0	broken
2	output layer only	3.6	3.5	15.6 / 14.8	degraded

TABLE III: HQQ at 3 and 2 bits.

P

: panda probability (%); seeds 41 / 42. “Degraded”: base probability below half its 16-bit value; “broken”: non-word answers. Output-only quantization is less disruptive.

			Subliminal students		Explicit students (matched)
Arrangement	$P_{\mathrm{base}}$	$P_{\mathrm{ctrl}}$	$P$	$R$	$P$	$R$
Full HQQ ( $+E$ )	14.8	17.5	65.2 / 71.6	1.33 / 1.40	56.5 / 57.9	1.16 / 1.19
negated ( $-E$ )	12.6	11.8	44.0 / 46.5	0.90 / 0.90	35.9 / 36.8	0.72 / 0.74
shuffle 1	7.5	10.8	44.0 / 53.5	0.93 / 1.11	42.8 / 41.4	0.95 / 0.90
shuffle 2	18.4	16.7	25.9 / 25.1	0.26 / 0.22	43.6 / 38.2	0.80 / 0.64
shuffle 3	13.4	15.8	70.2 / 76.8	1.52 / 1.58	50.1 / 47.2	1.02 / 0.92

TABLE IV:

P

: panda probability (%);

R

: net strength relative to 16 bits; pairs: seeds 41 / 42. HQQ’s 4-bit errors added unchanged, negated, or shuffled within groups of 64, preserving error magnitudes. Base, controls, and students receive the same transformation of their own errors. Subliminal net strength spans 0.22 to 1.58, compared with 0.64 to 1.19 for explicit students. NF4 provides a quantizer comparison.

Fig. 4: Net strength

R

when the same 4-bit error magnitudes are arranged differently: full HQQ (its own error

E

), the negated error, four random within-group shuffles, and NF4. Bars are the mean of the two seeds, whiskers the two seeds. Dashed line: unchanged from 16 bits; dotted line: the amplification threshold of § III-D . The subliminal students range from 0.2 to 1.6, the explicit students stay near 1.

Fine-tuning delta ( $\\|d\\|=5.67/5.78$ )
Condition	survival	$\cos(E_{s},E_{b})$
HQQ 4-bit	0.998 / 0.998	0.88 / 0.88
NF4 4-bit	0.994 / 0.994	0.96 / 0.96
Installed direction, layer 14
Condition	cosine	component
HQQ 8-bit	0.998 / 0.998	1.00 / 1.00

TABLE V: Internal signal preservation in subliminal students (seeds 41 / 42). Top: fine-tuning delta survival, measured as

\langle d_{Q},d\rangle/\langle d,d\rangle

across 196 transformer layers, and alignment between student and base rounding errors. Both quantizers preserve over 99% along the original delta. Bottom: cosine similarity and relative projection length of the layer-14 activation direction compared with its 16-bit version.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Setting	Value
Base model	Qwen2.5-7B-Instruct (bf16)
Training data	7,500 teacher completions per student
Adapter	LoRA, rank 8, $\alpha=8$
Adapted modules	q, k, v, o, gate, up, down projections, all 28 blocks
Loss	completion tokens only
Epochs	3

Appendix

TABLE VI: Student training configuration, identical for subliminal, control and explicit students. The output layer is never trained.

Quantization Robustness

See all 27 papers

May 2, 2026

Quantization Undoes Alignment: Bias Emergence in Compressed LLMs Across Models and Precision Levels

Large Language Models are routinely compressed via post-training quantization to reduce inference costs and memory footprint for cloud and edge deployment, yet the impact of this compression on model quality remains poorly understood. Existing studies typically compare only two conditions (full-precision vs. a single quantized variant), rely on aggregate bias metrics, and evaluate a single model family, making it impossible to distinguish gradual degradation from threshold-dependent safety failures. We conduct a controlled empirical study of three instruction-tuned models (Qwen2.5-7B, Mistral-7B, Phi-3.5-mini) at five precision levels (BF16 through 3-bit) on 12,148 BBQ bias benchmark items across 5 random seeds, totaling 911,100 inference records. Our results reveal that 3-bit quantization causes 6-21% of previously unbiased items to develop new stereotypical behaviors, following a clear dose-response pattern confirmed via logistic regression, while models' willingness to select "unknown" answers declines by 17.4%. Crucially, these item-level changes are invisible to standard quality metrics: perplexity increases by less than 0.5% at 8-bit and under 3% at 4-bit across all three models, yet 2.5-5.6% of items already develop new biases at 4-bit. These findings demonstrate that aggregate evaluation metrics systematically miss fairness-critical degradation, underscoring the need for quality-aware compression protocols that explicitly test for bias emergence before deployment.

Plawan Kumar Rath, Rahul Maliakkal

Steering Under Compression: Dose-Response, Capability Cost, and Failure Asymmetry in Quantized LLMs

Inference-time activation steering enables behavioral control of large language models without parameter modification, while post-training quantization reduces memory and compute costs for deployment. Despite their growing convergence in practice, the interaction between these two techniques remains uncharacterized. We systematically study activation steering under weight-only quantization (INT8 and NF4) across four open-weight 7-9B models and two behavioral targets: judged sentiment and judge-free reasoning length. Using an iso-effect framework that compares capability costs at matched behavioral effect, we find that sentiment steering survives quantization intact. After correcting a GSM8K parser artifact with a uniform v2.3.1 rescore, the pooled INT8 contrast is -0.010 (90% CI [-0.026, +0.007]), descriptively Equivalent under the preregistered three-label rule, while NF4 remains Inconclusive at -0.017 ([-0.067, +0.033]). In contrast, reasoning length exhibits a surprising asymmetric dose-response: lengthening is graded but terminates in cap-runaway and collapse, while shortening is a step function with only 12-30% shortening (model-dependent) before discontinuous failure. We expose a methodological pitfall: the naive iso-effect ladder anchors on the collapse floor for floor-bounded targets, and we introduce a censored construction that restores interpretable crossings. We also quantify a substantial baseline capability shift for Mistral-NF4 (0.545 to 0.365 GSM8K at alpha=0), demonstrating that compression can dominate the steering intervention. Despite this, steering vectors remain highly collinear with their FP16 siblings (cosine similarity 0.989-0.998 for INT8, 0.945-0.990 for NF4), confirming that the behavioral direction survives quantization even when the cost structure does not. All code and data are released.

Saurav Bhandari, Benjamin Wade

Department of Electronics and Computer Engineering Institute of Engineering, Thapathali Campus Tribhuvan University, Kathmandu, Nepal · Independent Researcher

Activation Steering LLM Quantization Weight-Only Quantization

Ask PDF

Feb 5, 2026

Investigating Social Bias Changes in Quantized Language Models

Post-training quantization reduces the memory needed to run large language models but alters their social biases in ways that aggregate metrics fail to capture. We present the first large-scale study of 50 quantized models evaluated on PostTrainingBiasBench, a unified benchmark of 13 closed- and open-ended bias datasets. We identify a phenomenon we term quantization-induced bias flipping, in which quantization causes models to change responses from biased to unbiased and vice versa, up to 21% of the time, despite no change in aggregate bias scores. These flips are strongly associated with model uncertainty, where the responses with high uncertainty are 3-11x more likely to change than the confident ones. Quantization strength amplifies this effect, with 4-bit quantized models exhibiting 4-6x more behavioral changes than 8-bit quantized models. Critically, these changes create asymmetric impacts across demographic groups, where bias can worsen by up to 18.6% for some groups while improving by 14.1% for others, yielding misleadingly neutral aggregate outcomes. Larger models show no consistent robustness advantage, and group-specific shifts vary unpredictably across model families. Our findings demonstrate that compression fundamentally alters bias patterns, requiring crucial post-quantization evaluation and interventions to ensure reliability in practice.

Stanley Z. Hua, Sanae Lotfi, Irene Y. Chen

UC Berkeley & UCSF · Meta Superintelligence Labs

LLM Quantization Social Bias in Language Models Language Model Bias Evaluation Linguistic Bias in Language Models Post-Training Quantization Neural Network Quantization