The same weights, a different quantizer, and the model behaves like a different model.

That is not a metaphor. A new arXiv paper (arXiv:2611.00665) reports a result strange enough to be worth sitting with: for the very same 4-bit quantized model, swapping the quantizer method changes behaviour by more than fourfold, and pushes it in opposite directions.

How the experiment was set up

The authors are Md Rayhanul Masud and Mst Suraiya Akter Shefa. They used Qwen2.5-7B-Instruct and followed the standard recipe for subliminal learning: a teacher copy of the model was prompted to prefer pandas and continued 30,000 number sequences. A neutral teacher continued the same sequences. Only clean number lists were kept, and 7,500 examples per teacher were sampled. Not one of those numbers contains the word panda, yet the student model trained on them ended up preferring pandas as its favourite animal.

Controls were built with exactly the same procedure, except their teacher had no preference. The measurement itself is deliberately narrow: 50 prompts asking for a one-word favourite animal, then the probability that the answer's leading token is panda, minus the same probability for the controls. That gap is the trait's net strength, normalized against its 16-bit value.

The baseline is clean. At 16 bits the subliminal students answered panda 53-56% of the time, while controls and the base model sat at about 17%.

The subliminal-learning phenomenon itself is not new. Cloud and colleagues published it in Nature (Vol 652, issue 8110, pages 615-621) in 2026; the earlier preprint is arXiv:2507.14805. What this new paper adds is putting that mechanism and quantization on the same table.

4-bit is the watershed

At 8 bits things are basically safe: under HQQ the students answered panda 56.5% and 56.9% of the time, with net strengths of 1.10 and 1.03. Nothing much moves.

At 4 bits the picture splits. Same layers quantized, same group size of 64 weights, both calibration-free:

  • HQQ: student panda probability rises to 60.9% and 66.9%, net strength R=1.23 and R=1.30
  • NF4: student panda probability falls to 27.9% and 29.5%, net strength R=0.27 and R=0.30

In the paper's tables the rounding-error norms of the two quantizers differ by about 4%, yet the net strength differs by more than four times. In other words, for one model at one deployment precision, the choice of quantizer decides which way the model's personality leans.

What decides the direction is not the size of the error but its arrangement

The authors then took HQQ's 4-bit rounding error out on its own and operated on it: magnitudes untouched, only the position or the sign changed within each group.

Four random shuffles sent the net strength anywhere between 0.22 and 1.58 times its 16-bit value. One arrangement amplified more than full HQQ did (1.52 and 1.58), another suppressed more than NF4 did (0.26 and 0.22); negating the error returned it to 0.90 and 0.90. And when Gaussian noise of the same per-layer norm replaced the structured error, all three draws lowered the panda probability, by 1-2, 6-9 and 20-22 percentage points. Not one draw amplified it.

The conclusion is that the magnitude of the error cannot explain the direction. The arrangement can.

The inside stays stable while the outside swings

The most striking part is the split between internal signal and outward behaviour. Both quantizers preserve over 99% of the fine-tuning delta along its original direction (HQQ 99.8%, NF4 99.4%). The layer-14 activation direction still shows a cosine similarity of 0.90 and 0.91 under 4-bit HQQ, with a relative component of 0.94 and 0.98.

Internally almost nothing broke, yet behaviour swings by a factor of four. The authors also rule out the simple explanation that 4-bit quantization just makes the whole model more confident: 4-bit HQQ lowers first-token entropy for the subliminal students by 0.22 nats, from 1.01 down to 0.79, pushing their top-token mass from 70% up to 81%, while the base and control models drop by only 0.05-0.08 nats. NF4 does the opposite, adding 0.14-0.16 nats to every model. The amplification lands precisely on the installed preference, not on the model in general.

One more detail is counter-intuitive: the output layer stores none of the trait, since the fine-tuning bypassed it entirely, and every student shares the base model's output weights. But quantizing only that untouched layer, at 3 bits, drops the students' panda probability from 53-56% down to 41-42%, while the base model barely moves (16.6% to 16.8%). The feature is not in there, but reading it out depends on it.

The boundaries of the claim

The authors' own Limitations section is candid. The study covers one model, one animal preference and one number-sequence recipe. The preference is benign, so the observed changes do not directly establish how quantization affects harmful behaviour. They ran two training seeds, three Gaussian noise draws and four error shuffles, so the experiments do not characterize the full range of possible outcomes. Only HQQ and NF4 were compared, only with groups of 64 weights, leaving other quantizers, group sizes and deployment settings untested. General capabilities were not systematically evaluated, so fluent answers on this task do not establish that broader performance is preserved. And the most important caveat: explicitly trained preferences at matched 16-bit strength are roughly five times less sensitive to quantizer choice, but the authors cannot separate the effect of the training method from the larger weight changes subliminal training happens to make.

So the accurate statement is narrower than the headline: in this recipe and on this model, quantization can push a subliminally installed preference toward amplification or toward suppression, and the direction is decided by how the rounding errors are arranged.

So what

The operational recommendation is blunt: safety evaluations must be run at the quantization setting you intend to deploy, and against that exact quantized weight. A 16-bit audit provides neither an upper nor a lower bound.

For anyone who compresses models to 4-bit as a matter of routine, this is a reminder. We tend to treat quantization as an engineering step that costs a little accuracy and buys memory. This paper suggests compression can itself be an invisible rewrite of behaviour. The code is public (github.com/mrayhanulmasud/subq), with the scripts and the notebook included.

The object of an audit is not "the model". It is the exact set of weights you are about to ship.