💬 NLP

Preserving Fairness and Safety in Quantized LLMs Through Critical Weight Protection

This paper reveals that quantization degrades fairness and safety in large language models, particularly in non-English contexts, and proposes a novel "Critical Weight Protection" technique to mitigate these risks without requiring costly retraining.

Original authors: Muhammad Alif Al Hakim, Alfan Farizki Wicaksono, Fajri Koto

Published 2026-06-30

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Muhammad Alif Al Hakim, Alfan Farizki Wicaksono, Fajri Koto

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a brilliant, multilingual librarian named "LLM" who knows everything about the world. This librarian is incredibly smart but also very heavy—so heavy that they need a massive, expensive library building (lots of computer memory) to store their books. To make the librarian easier to carry around and faster to consult, you decide to shrink their books. This process is called quantization. It's like photocopying a thick, high-resolution encyclopedia and compressing it into a thin, low-resolution pamphlet. You save space and speed up reading, but there's a catch: when you squish the information, some details get blurry or lost.

This paper asks a crucial question: When we shrink these AI "librarians" to make them faster, do they start saying mean things, acting unfairly, or becoming dangerous?

The Problem: The "Shrink Ray" Effect

The researchers found that when you shrink these models (quantize them), they often lose their moral compass.

Fairness: The librarian might start favoring certain groups of people over others or relying on harmful stereotypes, just like a person who has forgotten the nuances of different cultures.
Safety: The librarian might start agreeing to do dangerous things, like writing a guide on how to build a bomb, when they previously would have refused.

The study tested this on models speaking English, French, Dutch, Spanish, Turkish, Korean, and Arabic. They discovered that non-English languages suffered the most. It's as if the librarian, when shrunk, forgets the rules of etiquette for foreign guests much faster than for their native English-speaking guests.

Interestingly, some methods of shrinking (called "dynamic" methods) were like careful packing—keeping the books safe. Others (called "static" methods) were like throwing books into a box and shaking them; they caused more damage to the librarian's judgment.

The Solution: The "Critical Weight" Life Jacket

The authors realized they couldn't just shrink everything equally. Some parts of the librarian's brain are responsible for general knowledge (like knowing that Paris is in France), while other parts are responsible for their "safety and fairness" settings (like knowing not to insult someone's religion).

They invented a technique called Critical Weight Protection.

Think of the librarian's brain as a ship full of cargo.

The Scan: They run a test to find the "critical cargo"—the specific weights (or mental connections) that are most important for keeping the librarian fair and safe.
The Life Jacket: They put a special "life jacket" (keeping these specific parts in high-precision, full-quality format) on these critical pieces of cargo.
The Compression: They shrink the rest of the cargo (the general knowledge) into the low-resolution pamphlet format to save space.

The Result: The librarian remains small and fast (efficient), but because the "moral compass" parts were kept in high definition, they don't get lost in the compression. The librarian stays safe and fair, even while being lightweight.

What They Found

Without protection: Shrinking the model often made it more biased and less safe, especially in languages other than English.
With protection: Their new method successfully stopped the librarian from losing their moral compass. The model stayed just as fast and small, but it didn't start saying harmful things or treating people unfairly.
General Smarts: The librarian didn't lose their ability to answer normal questions; they just became safer and fairer.

The Bottom Line

You can make AI models smaller and faster without breaking their "good behavior," but you have to be careful. You can't just compress everything randomly. You have to identify the specific parts of the AI that handle fairness and safety, protect them with a "life jacket," and then compress the rest. This ensures that as we make AI more accessible and efficient, we don't accidentally turn our helpful librarians into biased or dangerous ones.

Technical Summary: Preserving Fairness and Safety in Quantized LLMs Through Critical Weight Protection

Problem Statement

Large Language Models (LLMs) are increasingly deployed in sensitive domains such as healthcare and education, necessitating rigorous adherence to fairness and safety standards. However, the massive parameter counts of these models create significant computational and memory barriers. Quantization, the process of reducing numerical precision (e.g., from 16-bit floating-point to 4-bit integers), is the standard solution for enabling efficient deployment.

While the impact of quantization on general task performance (e.g., perplexity, accuracy) is well-documented, its implications for fairness (intergroup equality) and safety (prevention of harmful outputs) remain under-explored. Existing literature often focuses on static quantization within English-language contexts, leaving critical gaps regarding:

Dynamic vs. Static Quantization: How different quantization paradigms affect alignment.
Multilingual Contexts: Whether safety and fairness degrade differently across languages (e.g., English vs. Korean, Arabic, French).
Mitigation: Whether it is possible to preserve alignment properties without costly retraining or re-alignment.

The authors posit that naive quantization may inadvertently distort alignment mechanisms, disproportionately affecting parameters responsible for filtering harmful content or ensuring equitable treatment across demographic groups.

Methodology

1. Systematic Evaluation Framework

The authors conducted a comprehensive evaluation across three model families (Gemma-7B-Instruct, Llama-3.1-8B-Instruct, Qwen-2.5-7B-Instruct) using five quantization methods:

Static: GPTQ, AWQ, SmoothQuant.
Dynamic: FP8, LLM.int8().

Fairness Evaluation:

Intrinsic Bias: Measured via StereoSet (English) and CrowS-Pair (English/French) to assess stereotypical associations.
Extrinsic Bias: Measured via Jigsaw (toxicity classification) and MBBQ (question-answering across English, Dutch, Spanish, and Turkish) to assess performance disparities in downstream tasks.

Safety Evaluation:

Benchmarks included SafetyBench (multiple-choice safety), Do-Not-Answer (refusal of harmful instructions), HEx-PHI (harmful prompts with diverse decoding strategies), and MultiJail (multilingual jailbreak attempts in English, Korean, and Arabic).

2. Proposed Solution: Critical Weight Protection

To address the degradation of trustworthiness, the authors propose Critical Weight Protection, a mixed-precision quantization strategy inspired by sensitivity analysis in medical imaging.

Core Concept: Not all weights contribute equally to fairness and safety. The method identifies and preserves "critical" weights in their original high precision (FP16) while quantizing the remaining weights to lower precision (INT4).
Scoring Mechanism:
- Sensitivity Calculation: The importance of a weight $\theta$ is determined by the squared gradient of the loss function with respect to that weight. This approximates the diagonal of the Fisher Information Matrix.
- Fairness Score (FAIRSCORE): Calculated as the difference between the sensitivity to fairness loss ( $I_{fair}$ ) and general capability loss ( $I_{gen}$ ), scaled by a hyperparameter $\beta$ :
  $FAIRSCORE(\theta) = I_{fair}(\theta) - \beta \cdot I_{gen}(\theta)$
  Where $I_{fair}$ is derived from the StereoSet dataset (encouraging equal probability for stereotypical and anti-stereotypical completions).
- Safety Score (SAFESCORE): Calculated similarly using safety-specific loss (derived from AdvBench) and general loss (derived from Databricks Dolly).
- Final Ranking: The final score for ranking weights is the sum: $FAIRSCORE + SAFESCORE$.
Execution: The top $k\%$ of weights with the highest scores are retained in FP16. The remaining weights are quantized to INT4. This approach requires no retraining or alignment tuning.

Key Results

1. Impact of Quantization on Fairness and Safety

General Degradation: Quantization consistently degrades fairness and safety compared to full-precision baselines.
Static vs. Dynamic: Dynamic quantization methods (FP8, LLM.int8()) demonstrated greater stability and closer alignment to full-precision performance than static methods (GPTQ, AWQ, SmoothQuant).
Language Disparities:
- Safety: Deterioration was especially pronounced in non-English settings (Korean and Arabic), where safety mechanisms were less robust post-quantization.
- Fairness: Intrinsic bias (e.g., CrowS-Pair) showed higher sensitivity to quantization in English, while extrinsic bias (MBBQ) showed greater instability in non-English downstream tasks.
Model Sensitivity: Smaller models (7B-8B range) exhibited more divergence in safety performance under quantization compared to larger models.

2. Effectiveness of Critical Weight Protection

The proposed method (denoted as AWQ-trust when applied to AWQ quantization) significantly mitigated these risks:

Fairness: Protected models maintained or improved fairness scores (e.g., StereoSet ICAT, Jigsaw BiasAUC) compared to standard quantized models, often matching or exceeding full-precision baselines.
Safety: The method substantially increased resistance to harmful instructions. Notably, it reversed the safety degradation observed in non-English languages (Korean and Arabic), achieving significant gains in MultiJail safety scores.
General Utility: Evaluation on AlpacaEval confirmed that preserving critical weights did not compromise general instruction-following capabilities or win rates against reference models.
Comparison: The gradient-sensitivity approach outperformed SNIP-based identification methods (used in prior work like Q-resafe), particularly at higher compression rates.

Significance and Claims

The paper claims that quantization is not neutral regarding AI trustworthiness; it systematically amplifies bias and weakens safety alignment, particularly in multilingual contexts.

The primary contribution is the demonstration that alignment-aware quantization is feasible without the computational cost of retraining. By selectively preserving weights critical to fairness and safety, the authors show that:

Efficiency and Trustworthiness are not mutually exclusive: One can achieve significant model compression while retaining high standards of safety and fairness.
Language Matters: Non-English deployments are more vulnerable to quantization-induced safety failures, necessitating specific mitigation strategies.
Scalability: The proposed "Critical Weight Protection" is a practical, post-training technique that can be integrated into existing quantization pipelines (demonstrated here with AWQ and GPTQ) to safeguard responsible AI deployment.

The authors conclude that while their study is limited to specific model families and standard benchmarks, the findings provide practical guidelines for responsible LLM compression, urging a shift from uniform compression to alignment-aware strategies.