Study: signed LLM weights don't verify the quantized files you run

Across 198 popular GGUF repos, zero could be independently re-derived

Model signing is supposed to guarantee that the weights a user runs match what a provider released. A new paper from Wei-Liang Liu and Cheng-Yen Tsai argues that guarantee quietly breaks the moment those weights get quantized. Quantization compresses a model into the GGUF files most people actually download and run. Model signing authenticates the full-precision weights, the authors note. But the quantized artifact a user executes comes from a transformation that current disclosure practices don't pin down.

The paper introduces a metric for this gap: the Independent Verifiability Rate. It is defined as the share of a popularity-sampled GGUF ecosystem a third party can re-derive bit-for-bit. The authors checked the 200 most-downloaded Hugging Face GGUF repositories, of which 198 were in scope. None recorded the build environment on the artifact or model card. That put the measured IVR at 0/198.

The files are not inherently unreproducible, though. On four repositories that did disclose their inputs, the card's stated information alone failed to rebuild any Q4_K_M file. Adding two coordinates the cards omitted changed that. Those were the build's floating-point-contraction setting and, for hybrid models, the per-tensor quantization recipe. With both in hand, the authors re-derived seven of eight target quantized files bit-for-bit on x86, and five of eight on arm64.

Some pieces resisted reproduction entirely. The calibration imatrix, a file used in some quantization recipes, had to be shipped alongside the model and bound to a hash. Recomputing it from scratch did not match the original. An older release in the sample also needed its exact instruction set pinned, and still failed to re-derive. Working from a divergence already reported in a llama.cpp pull request, the authors identified one compiler setting that produces a unique output across the platforms they tested. The cost of pinning it was just 0.06 percentage points of perplexity, a measure of how well the model predicts text.

The security implications cut both ways. Benign floating-point non-determinism, the ordinary variation that comes from different hardware or compilers, can be statistically separated from random nibble-flip tampering. The gap between the two grows as a verifier has to tolerate more environments. But a targeted edit to the model's embeddings evaded that detection statistic entirely. That means the proposed protocol only works when it demands exact bit-for-bit re-derivation rather than statistical plausibility. The authors say attacks against fp16 precision fall outside what their method can catch. They have released the audit data and a re-runnable harness.

Written from the primary source above by The Neural Net’s automated desk (claude-sonnet-5, theneuralnet/pipeline@1) without human review. How this works. Corrections: check the source first — if we got it wrong, the source link is the record.