Hidden Reliability Risks in Large Language Models: Systematic Identification of Precision-Induced Output Disagreements

1. Problem Statement

Large Language Models (LLMs) are increasingly deployed using diverse numerical precision configurations (e.g., bfloat16, float16, int16, int8) to optimize for efficiency and resource constraints. While these precision changes are assumed to be functionally benign, the authors identify a critical reliability gap: precision-induced behavioral disagreements.

• The Core Issue: A model may behave safely under one precision setting (e.g., bfloat16) but produce harmful, jailbroken outputs under another (e.g., float16 or int8) when given the exact same input.
• The Gap: Existing evaluation methods typically test models under a single precision setting. Consequently, safety alignments verified during development (often in high precision) may fail silently in production environments using lower precision.
• The Challenge: These discrepancies are subtle, difficult to detect via random testing, and occur in the discrete token space of LLMs, making them hard to locate without specialized optimization.

2. Methodology: PrecisionDiff

The authors propose PrecisionDiff, the first automated differential testing framework designed to systematically detect these precision-induced inconsistencies. The framework operates in two main stages:

A. Dual-Precision Differential Testing

PrecisionDiff treats the same model weights running under two different precision configurations (e.g., $f^{(p1)}_\theta$ and $f^{(p2)}_\theta$) as distinct implementations. It searches for adversarial suffixes ($x_{adv}$) that trigger divergent behaviors.

• Objective: Find an input $x = x_{user} \oplus x_{adv}$ such that the model produces a safe refusal under precision $p_1$ but a harmful response under precision $p_2$.
• Joint Optimization Strategy: The framework employs a dual-precision joint loss function:
  $$\min_{x_{adv}} \left[ \mathcal{L}(f^{(p2)}_\theta(x), y_{harm}) + \lambda \mathcal{L}(f^{(p1)}_\theta(x), y_{safe}) \right]$$
  • This simultaneously optimizes for a jailbreak in the target precision ($p_2$) while enforcing safety in the reference precision ($p_1$).
  • This acts as a regularizer, pushing the search toward the narrow "precision-sensitive decision boundary" rather than the center of the jailbreak region.
• Search Algorithm: Since LLM tokens are discrete, the framework uses a Momentum-Guided Coordinate Gradient (GCG) approach:
  • It computes gradients for both loss terms with respect to token embeddings.
  • It aggregates these gradients to form a joint direction.
  • It uses a momentum buffer to stabilize the search across the non-convex landscape.
  • It selects Top-$K$ candidate tokens based on the aggregated gradient direction.

B. Root-Cause Analysis (Layer-wise Divergence)

Once a divergent input is found, PrecisionDiff localizes the source of the error within the model architecture.

• Metrics: It calculates the Mean Absolute Difference (MAD) and Relative Divergence Lift (RL) between the activations of the two precision models at each layer.
• Goal: Identify "critical layers" where numerical errors are amplified, providing actionable targets for selective precision elevation (e.g., keeping specific layers in higher precision).

3. Key Contributions

1. PrecisionDiff Framework: The first automated tool for detecting precision-induced behavioral inconsistencies in LLMs, capable of generating precision-sensitive test inputs.
2. Safety Alignment Verification: A novel instantiation of differential testing on safety alignment, revealing that numerical precision is a critical, previously overlooked source of alignment failure (jailbreak divergence).
3. Systematic Analysis: Comprehensive evaluation across five open-source aligned LLMs (Llama-2, Llama-3, Mistral, Vicuna, Guanaco) and multiple precision transitions (BF16/FP16, INT16/INT8).
4. Architectural Insights: Identification of specific network components (input layers, attention mechanisms, output heads) that act as amplification sites for precision errors.

4. Experimental Results

Prevalence of Divergence (RQ1)

• High Success Rates: Precision-induced jailbreaks are widespread. Across five models, the average success rate for detecting divergence was 84.0% for BF16 vs. FP16 and 99.5% for INT16 vs. INT8.
• Model Sensitivity:
  • Mistral-7B was the most susceptible (up to 100% success).
  • Llama-2-7B showed lower sensitivity to floating-point shifts but remained highly vulnerable to integer quantization (98% success for INT16 vs. INT8).
• Content Sensitivity: Technical categories like Cybercrime (92.9%) and Malware (90.9%) were most susceptible, while socially sensitive topics like Misinformation were less so, suggesting alignment guardrails are tighter for the latter.

Effectiveness vs. Baselines (RQ2)

PrecisionDiff significantly outperformed existing differential testing and jailbreak methods:

• Vs. Standard GCG: PrecisionDiff achieved a 1.4× higher success rate on Vicuna-7B and an 8.5× higher success rate on Llama-2-7B.
• Vs. Random/Fuzzing: Conventional methods (Random Search, AFL++, Genetic Algorithms) achieved success rates below 8.0%, confirming that precision-sensitive boundaries are too narrow for unguided exploration.
• Efficiency: While PrecisionDiff has a ~1.88× per-iteration time overhead (due to running two models), it requires fewer iterations to succeed, resulting in comparable total wall-clock time with vastly superior detection coverage.

Robustness (RQ3)

• Stochastic Decoding: The framework remains effective even with do_sample=True (sampling), where success rates often increased due to the compounding effect of sampling randomness and precision noise.
• Budget Constraints: Even with a 60% reduction in optimization steps (200 vs. 500), PrecisionDiff maintained success rates above 50%, demonstrating practical efficiency.

Internal Mechanisms (RQ4)

Layer-wise analysis revealed that divergence is not uniform but concentrated in specific "amplification hotspots":

1. Input-Stage Layers (Layer 0): Small rounding errors here propagate through the entire network.
2. Attention Mechanisms ($W_Q, W_K$): Matrix multiplications in early blocks accumulate rounding errors, which are exponentially amplified by the Softmax function.
3. Output-End Modules: LayerNorm and the final Head layer are highly sensitive to precision changes, directly affecting the final logit distribution.

5. Significance and Implications

• Safety Criticality: The findings challenge the assumption that precision changes are benign. A model deemed "safe" during high-precision testing may be unsafe in low-precision production environments.
• Embodied AI & Agents: The risk is amplified for autonomous agents and embodied AI, where a precision-induced jailbreak could lead to unsafe physical actions or the propagation of harmful instructions in automated pipelines.
• Mitigation Strategies: The paper suggests selective precision elevation—keeping critical layers (Input, Attention, Output) in higher precision (e.g., FP32/BF16) while quantizing intermediate layers—to suppress divergence without sacrificing overall efficiency.
• Future Directions: Highlights the need for "precision-robust" training and evaluation pipelines that account for deployment-specific numerical configurations.

In conclusion, PrecisionDiff exposes a hidden class of reliability risks in LLMs, demonstrating that numerical precision is a fundamental variable in model safety that must be rigorously tested before deployment.