AI 評測與安全
QuantiBias Finds Quantized Models Can Pass Short-Form Safety Tests Yet Still Produce Stereotypes in About a Quarter of Open-Ended Responses
QuantiBias holds the model and prompts constant while varying only weight precision, measuring multilingual open-ended bias, refusals, and multiple-choice performance before and after quantization. The authors find that common short-form safety metrics remain broadly stable, yet an independent judge model still classifies about 24% to 27% of open-ended responses as endorsing stereotypes.
The newly released QuantiBias benchmark treats post-training quantization as a deployment change that requires safety evaluations to be rerun, rather than as a purely numerical optimization. Its methodology holds the model architecture, training, and prompts constant while swapping in weights at different precision levels, then measures harmful-request refusals, excessive refusals of benign questions, multiple-choice bias, and the rate at which models proactively generate stereotypes across eight languages.
For the Qwen3.6-27B quantization ladder, the authors report that StrongREJECT’s direct refusal rate remains around 0.98, while XSTest over-refusal and BBQ multiple-choice scores also remain broadly unchanged. However, when Claude Sonnet-5— from a different model family—serves as the judge, the stereotype-endorsement rate in open-ended MBTP responses rises from about 24% to 27%. A second backbone, Gemma-4-31B, increases from 27.6% to 31.7%, while another generative CEB test rises from 13.5% to 37.6%. The study’s central conclusion is not that every compression level causes monotonic degradation, but that short-answer checks may completely miss shifts in generative behavior.
The open-source tooling can recombine eight upstream benchmarks, generate inference outputs, use cross-model judges to label stance and severity, and calculate actual bits per weight from GGUF files. This matters because the authors note that nominal quantization labels may understate total storage costs; deployment teams should compare risk using the actual resulting artifacts rather than the names of quantization methods.
However, the results depend heavily on LLM judges, prompt sampling, and sociocultural classifications. The authors also acknowledge that whether bias consistently increases with compression varies by judge, and the Hugging Face dataset viewer currently shows a schema-conversion error. Engineering teams should retest using multiple judges from different model families, human spot checks, and the product’s real-world language distribution. A single percentage should not be treated as a safety certification.