Post-training quantization is usually treated as a semantically neutral optimization, almost an infrastructural detail for bringing a Large Language Model to edge devices. The work under review shows that this is precisely where a structural attack can hide. The problem is not in the source model, but in the gap between what is validated and what is deployed.

When a full-precision checkpoint is evaluated and then quantized without an equivalent re-evaluation, a validation-deployment gap emerges. Quantization is a many-to-one mapping in parameter space: multiple full-precision configurations collapse into the same compressed representation. Source-precision certification does not guarantee behavioral equivalence in the deployed configuration.

The paper formalizes this gap through Quantization Behavioral Equivalence Classes, demonstrating that membership in the same class does not imply behavioral equivalence. This provides the theoretical basis for quantization-triggered backdoors. The authors built a three-stage adversarial fine-tuning framework, embedding latent malicious payloads that pass full-precision checks and activate only under INT8 or 4-bit compression. They extended prior tests from decoder-only causal models to multilingual encoder-decoder sequence-to-sequence models, using two operationally motivated scenarios: tactical machine translation and political content analysis.

The numbers show the scale of the shift: backdoored translation models move from zero measured friend-foe corruption at repaired FP16 to up to 85.02% inversion after quantization. A paired stance classifier records an ideological shift of up to ΔBias=0.33 upon compression. The cross-quantizer transferability analysis shows that attack persistence varies across quantization schemes and model architectures, rather than being determined by nominal bit-width alone.

The resulting thesis is clear: security auditing that stops at source precision is a relic. For edge and on-premise AI, behavioral certification must include the final compressed configuration. This moves the trust perimeter from the model to the model-compression pair and, prospectively, to the software-hardware combination.

For those managing self-hosted or air-gapped deployments, direct control becomes a new burden: testing the model is not enough; every compression path used in production must be tested. Hardware and runtime vendors can no longer focus only on throughput; variability across quantization schemes and architectures signals that validation cost is part of TCO. Attackers exploiting automated compression pipelines win today; those who based compliance guarantees solely on the source checkpoint lose. Structurally, this pushes toward a revision of audit practices: the security of compressed LLMs is not a property of the model, but of the distributed system. For those evaluating on-premise deployment, AI-RADAR offers analytical frameworks at /llm-onpremise to weigh these trade-offs.