Technical Summary: QuantiBias

Problem Statement

Large Language Models (LLMs) are typically trained in full precision but deployed in compressed, quantized forms to improve efficiency. While this compression step is assumed to be harmless regarding model safety, the paper argues that standard safety evaluations fail to detect a specific, deleterious side effect: an increase in open-ended bias.

Current safety metrics primarily rely on short-form checks, such as the refusal rate of harmful prompts or the accuracy of multiple-choice bias avoidance. The authors posit that these metrics are insufficient because they average over brief exchanges where quantization causes minimal damage. Consequently, a quantized model may pass all standard safety audits (refusing harmful requests and selecting unbiased multiple-choice answers) while simultaneously generating significantly more biased content in open-ended, generative tasks. This phenomenon is described as a "selective safety gap," where the model's refusal mechanisms remain intact, but its tendency to volunteer stereotypes in free-form generation increases measurably.

Methodology

The paper introduces QuantiBias, a benchmark designed to isolate and measure this specific failure mode. The methodology involves several key technical components:

1. Effective Bits Per Weight (bpw) Measurement:
   Standard quantization labels (e.g., "4-bit") are often nominal and do not reflect the actual precision of the deployed artifact, as many modern quantization schemes retain high-precision components (embeddings, attention heads) while compressing others. The authors measure the effective bits per weight directly from the artifact file by summing the bytes of all weight tensors and dividing by the parameter count. This ensures results are indexed to the true compression level rather than misleading labels.

2. Generative, Multilingual Probe (MBTP):
   The core of the benchmark is a generative probe based on the Multilingual Bias Test (MBTP). It consists of 320 open-ended prompts across eight languages (Arabic, Chinese, English, French, German, Japanese, Russian, Spanish) and 13 social categories. Each item pairs an open-ended request with a stereotype-endorsing claim and a group-swapped counterpart to fix the scoring axis. This design captures bias that multiple-choice instruments miss.

3. Control Mechanisms:
   To prove the effect is selective to open-ended generation, QuantiBias pairs the generative probe with:

   • Refusal Controls: Measuring the refusal rate of directly harmful requests (StrongREJECT) and over-refusal of benign prompts (XSTest).
   • Multiple-Choice Controls: Measuring bias avoidance in ambiguous multiple-choice questions (BBQ).
   • Next-Token Controls: Measuring short-form bias via StereoSet.

4. Reasoning-Load Contrast:
   The evaluation is conducted in two modes: with deliberation (reasoning) enabled and disabled. This tests whether the "fast path" (non-deliberative generation) is more susceptible to quantization-induced bias than the "slow path."

5. Scoring and Severity:
   Generations are scored by an independent judge (Claude Sonnet-5 and Gemini-2.5-pro) to avoid self-preference bias. The scoring distinguishes between neutral responses and stereotype endorsements. Additionally, a content-severity rubric (0–4 scale) is applied to quantify the harmfulness of the endorsed stereotypes, moving beyond simple binary classification.

Key Results

The study evaluates two backbone models (Qwen3.6-27B and Gemma-4-31B) across a five-family screen and eight benchmarks.

• Selective Blindness of Standard Metrics: Across the quantization ladder (from 16-bit down to ~1-bit), the standard safeguards remain flat. Refusal rates for harmful requests stay near 0.98, and multiple-choice bias avoidance (BBQ) remains near 0.97. A standard audit would conclude the model is safe.
• Rise in Open-Ended Bias: In contrast, the rate of stereotype endorsement in open-ended generation is high and increases with compression. Under an independent judge, the model volunteers a stereotype in roughly one in four open-ended answers (~24% to ~27%) across the compression ladder. This rate is significantly higher than the baseline and remains robust across different judges.
• Reasoning as a Partial Safeguard: The effect is concentrated on the non-deliberative path. Enabling reasoning roughly halves the bias rate on the Qwen backbone but has little to no effect on the Gemma backbone, indicating that the mitigation is family-dependent and not universal.
• Severity of Endorsements: The bias is not merely a statistical fluctuation; the endorsed content often carries real harm. Of the instances flagged as endorsements, the mean severity score was 1.83 on a 0–4 scale, with 33 of 48 instances scoring 2 or higher (stated group generalizations).
• Mechanism: The paper posits that quantizers allocate precision based on calibration data (coding and chat) that carries no bias-prevention signal. Consequently, weights critical for suppressing open-ended stereotypes (which sit behind narrow decision margins) are left fragile and degrade first, while weights for overt refusal (reinforced by alignment training) sit behind wide margins and survive.

Significance and Claims

The paper claims three primary contributions:

1. Documentation of Selective Blindness: It establishes that current safety evaluations are blind to a specific failure mode where quantization degrades open-ended generative behavior while preserving short-form safety metrics. A model can pass every standard check and still reach users with measurably higher bias.
2. Mechanistic Insight: It provides a theoretical account for why this happens: quantization perturbs all weights, but behaviors with narrow decision margins (like avoiding subtle stereotypes in free text) degrade first, while those with wide margins (like refusing overt harm) survive. It also highlights that quantizers have no incentive to protect bias-critical weights because their calibration data does not exercise them.
3. Evaluation Instrument: It introduces QuantiBias as a necessary tool for re-evaluating quantized builds. The authors argue that a quantized model must be re-evaluated for open-ended bias, not just on the short-form safeguards it already passes.

The paper concludes that while the "selective gap" is a robust finding across judges and families, the specific slope of bias increase with compression is less certain and sensitive to the judge used. However, the core finding—that quantization introduces a hidden layer of bias invisible to standard safety checks—remains a critical concern for the deployment of compressed LLMs.