[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-hqq-nf4-quantization-reshapes-hidden-preference":3,"topics-all":38,"news-related-f1e161e0-c1b1-46e9-91cb-d3d11384e897":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"f1e161e0-c1b1-46e9-91cb-d3d11384e897","4-bit 量化让模型性格分叉:审计必须跑在部署精度上","给 Qwen2.5-7B 植入的隐性「熊猫偏好」,在 4-bit 量化下会被量化器改写方向:HQQ 把净强度推到 1.3 倍,NF4 压到 0.3 倍。内部信号保留 99% 以上,外在行为却差出四倍。作者主张安全评测必须跑在部署的那份量化权重上,而不是 16-bit。","同一份权重，换个量化器，模型就像换了一个人。\n\n这不是比喻。arXiv 上一篇新论文（[arXiv:2611.00665](https:\u002F\u002Farxiv.org\u002Fabs\u002F2611.00665)）给出了一个足够反直觉的结果：同一份 4-bit 量化模型，换量化方法，行为差异能超过四倍，而且方向完全相反。\n\n## 实验是怎么做的\n\n作者是 Md Rayhanul Masud 和 Mst Suraiya Akter Shefa，模型用 Qwen2.5-7B-Instruct，走的是「隐性学习」（subliminal learning）标准配方：先让一个被提示「喜欢熊猫」的教师模型生成 30000 条纯数字序列，再抽 7500 条喂给学生模型做 LoRA 微调。这些数字里没有出现过「熊猫」这个词，但学生模型学会了「最喜欢的动物是熊猫」。\n\n对照组用同样方法、只是教师没有偏好训练。对照方法很克制：拿 50 个提示问「你最喜欢的动物是什么」，统计首 token 是 panda 的概率，减去对照组概率，得到这个特征的「净强度」，再以 16-bit 下的净强度归一化为 1。\n\n结果很干净：16-bit 下学生模型的熊猫概率是 53%-56%，对照组和基座模型都在 17% 左右。\n\n「隐性学习」这个现象本身不是新东西——Cloud 等人 2026 年把它正式发在了 Nature（Vol 652, 8110 期, 615-621 页）上，早前的预印本是 [arXiv:2507.14805](https:\u002F\u002Farxiv.org\u002Fabs\u002F2507.14805)。这篇新论文的贡献，是把这个机制和量化放到同一张桌子上。\n\n## 4-bit 是分水岭\n\n8-bit 基本安全：HQQ 在 8-bit 下学生模型概率 56.5%\u002F56.9%，净强度 1.10\u002F1.03，几乎没动。\n\n4-bit 就裂开了。同样只量化 Transformer 层、同样 64 权重组、同样不需要校准数据：\n\n- **HQQ**：学生模型熊猫概率升到 60.9%\u002F66.9%，净强度 R=1.23\u002F1.30\n- **NF4**：学生模型降到 27.9%\u002F29.5%，净强度 R=0.27\u002F0.30\n\n论文表格里，两种量化器的舍入误差范数只差约 4%，净强度却差出四倍以上。也就是说，同一份模型、同一个部署精度，选哪个量化器，模型的「性格」就往相反方向跑。\n\n## 决定方向的不是误差大小，是误差排列\n\n作者把 HQQ 在 4-bit 下的舍入误差单独拎出来做手术：大小完全不变，只改它在组内的位置或符号。\n\n结果：4 次随机打乱，净强度在 0.22 到 1.58 之间乱跳。其中一组比完整 HQQ 放大得更狠（1.52\u002F1.58），另一组比 NF4 压得更狠（0.26\u002F0.22）；把误差取反则回到 0.90\u002F0.90。而用同样范数的高斯噪声替代，三次抽样全是下降 1 到 22 个百分点，没有一次出现放大。\n\n结论是：误差的「量」解释不了方向，「排列」才能。\n\n## 内部信号稳得离谱，外在行为却在飞\n\n最有意思的是内外分裂。两种量化器都保留了超过 99% 的微调增量（沿原方向的投影：HQQ 99.8%，NF4 99.4%）；第 14 层的激活方向在 4-bit HQQ 下余弦相似度还有 0.90\u002F0.91，强度分量 0.94\u002F0.98。\n\n内部几乎没坏，行为却能摆动四倍。作者还排除了「4-bit 让模型整体更自信」这个解释：4-bit HQQ 把学生模型的首 token 熵从 1.01 降到 0.79、top-token 质量从 70% 拉到 81%，而基座和对照组只降了 0.05-0.08 nats；NF4 反而对所有模型都加了 0.14-0.16 nats。放大是精准打在那个被植入的偏好上的，不是全局副作用。\n\n还有一处细节挺反直觉：输出层根本不存这个特征（微调完全绕过了它），但只量化输出层、在 3-bit 下，学生模型的熊猫概率就从 53%-56% 掉到 41%-42%，而基座模型几乎不动（16.6% 到 16.8%）。特征不在那儿，读出它却要靠它。\n\n## 这份结论的边界\n\n作者在 Limitations 里列得挺老实：只测了一个模型、一种动物偏好、一种数字序列配方；偏好是良性的，不能直接推出量化对有害行为的影响；只跑了两个训练种子、三次噪声抽样、四次打乱；只比较了 HQQ 和 NF4、只测 64 权重组、只覆盖这两个量化器；也没系统评估通用能力，所以「这个任务上答得流畅」不等于「模型整体没退化」。最要紧的一条是：显式训练出来的同等强度偏好稳定得多（净强度区间只有隐式训练的大约五分之一宽），但作者无法区分这份敏感性到底来自训练方式，还是来自隐式训练改动的权重幅度更大。\n\n所以更准确的说法是：在这一套配方和这一个模型上，量化能把隐式植入的偏好推向放大或压制两个相反方向，方向由舍入误差的排列决定。\n\n## 所以呢\n\n论文给出的操作建议非常直接：安全评测必须在打算部署的那个量化精度上做，而且要测那一版具体的量化权重——16-bit 的审计结果既不能当上界也不能当下界。\n\n这对天天把模型压到 4-bit 跑的人是个提醒：我们习惯把量化当成「几乎无损但更省」的工程步骤，但这篇论文说明压缩过程本身可能就是一道看不见的行为改写工序。代码已开源（[github.com\u002Fmrayhanulmasud\u002Fsubq](https:\u002F\u002Fgithub.com\u002Fmrayhanulmasud\u002Fsubq)），脚本和 notebook 都在。\n\n真正的审计对象不是「模型」，是「你要上线的那一份权重」。","https:\u002F\u002Farxiv.org\u002Fabs\u002F2611.00665","7437aeb9-930c-4866-a2e9-48003c1a792b",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",{"id":19,"name":20,"slug":20,"description":14,"color":14},"b49648f9-963e-4082-8684-3d085b7358fe","quantization",{"id":22,"name":23,"slug":23,"description":14,"color":14},"c187600e-804c-4697-b828-1e4330e0eb10","qwen",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"b99cfb31-33f9-49f0-9cae-6aad00b01bcb","en","Quantization Reshapes a Hidden Preference: Audit at 4-bit","Hidden panda preference in Qwen2.5-7B flips under 4-bit quantization: HQQ 1.3x, NF4 0.3x, fourfold gap, 99% of signal intact. Audit deployed weights.","The same weights, a different quantizer, and the model behaves like a different model.\n\nThat is not a metaphor. A new arXiv paper ([arXiv:2611.00665](https:\u002F\u002Farxiv.org\u002Fabs\u002F2611.00665)) reports a result strange enough to be worth sitting with: for the very same 4-bit quantized model, swapping the quantizer method changes behaviour by more than fourfold, and pushes it in opposite directions.\n\n## How the experiment was set up\n\nThe authors are Md Rayhanul Masud and Mst Suraiya Akter Shefa. They used Qwen2.5-7B-Instruct and followed the standard recipe for subliminal learning: a teacher copy of the model was prompted to prefer pandas and continued 30,000 number sequences. A neutral teacher continued the same sequences. Only clean number lists were kept, and 7,500 examples per teacher were sampled. Not one of those numbers contains the word panda, yet the student model trained on them ended up preferring pandas as its favourite animal.\n\nControls were built with exactly the same procedure, except their teacher had no preference. The measurement itself is deliberately narrow: 50 prompts asking for a one-word favourite animal, then the probability that the answer's leading token is panda, minus the same probability for the controls. That gap is the trait's net strength, normalized against its 16-bit value.\n\nThe baseline is clean. At 16 bits the subliminal students answered panda 53-56% of the time, while controls and the base model sat at about 17%.\n\nThe subliminal-learning phenomenon itself is not new. Cloud and colleagues published it in Nature (Vol 652, issue 8110, pages 615-621) in 2026; the earlier preprint is [arXiv:2507.14805](https:\u002F\u002Farxiv.org\u002Fabs\u002F2507.14805). What this new paper adds is putting that mechanism and quantization on the same table.\n\n## 4-bit is the watershed\n\nAt 8 bits things are basically safe: under HQQ the students answered panda 56.5% and 56.9% of the time, with net strengths of 1.10 and 1.03. Nothing much moves.\n\nAt 4 bits the picture splits. Same layers quantized, same group size of 64 weights, both calibration-free:\n\n- **HQQ**: student panda probability rises to 60.9% and 66.9%, net strength R=1.23 and R=1.30\n- **NF4**: student panda probability falls to 27.9% and 29.5%, net strength R=0.27 and R=0.30\n\nIn the paper's tables the rounding-error norms of the two quantizers differ by about 4%, yet the net strength differs by more than four times. In other words, for one model at one deployment precision, the choice of quantizer decides which way the model's personality leans.\n\n## What decides the direction is not the size of the error but its arrangement\n\nThe authors then took HQQ's 4-bit rounding error out on its own and operated on it: magnitudes untouched, only the position or the sign changed within each group.\n\nFour random shuffles sent the net strength anywhere between 0.22 and 1.58 times its 16-bit value. One arrangement amplified more than full HQQ did (1.52 and 1.58), another suppressed more than NF4 did (0.26 and 0.22); negating the error returned it to 0.90 and 0.90. And when Gaussian noise of the same per-layer norm replaced the structured error, all three draws lowered the panda probability, by 1-2, 6-9 and 20-22 percentage points. Not one draw amplified it.\n\nThe conclusion is that the magnitude of the error cannot explain the direction. The arrangement can.\n\n## The inside stays stable while the outside swings\n\nThe most striking part is the split between internal signal and outward behaviour. Both quantizers preserve over 99% of the fine-tuning delta along its original direction (HQQ 99.8%, NF4 99.4%). The layer-14 activation direction still shows a cosine similarity of 0.90 and 0.91 under 4-bit HQQ, with a relative component of 0.94 and 0.98.\n\nInternally almost nothing broke, yet behaviour swings by a factor of four. The authors also rule out the simple explanation that 4-bit quantization just makes the whole model more confident: 4-bit HQQ lowers first-token entropy for the subliminal students by 0.22 nats, from 1.01 down to 0.79, pushing their top-token mass from 70% up to 81%, while the base and control models drop by only 0.05-0.08 nats. NF4 does the opposite, adding 0.14-0.16 nats to every model. The amplification lands precisely on the installed preference, not on the model in general.\n\nOne more detail is counter-intuitive: the output layer stores none of the trait, since the fine-tuning bypassed it entirely, and every student shares the base model's output weights. But quantizing only that untouched layer, at 3 bits, drops the students' panda probability from 53-56% down to 41-42%, while the base model barely moves (16.6% to 16.8%). The feature is not in there, but reading it out depends on it.\n\n## The boundaries of the claim\n\nThe authors' own Limitations section is candid. The study covers one model, one animal preference and one number-sequence recipe. The preference is benign, so the observed changes do not directly establish how quantization affects harmful behaviour. They ran two training seeds, three Gaussian noise draws and four error shuffles, so the experiments do not characterize the full range of possible outcomes. Only HQQ and NF4 were compared, only with groups of 64 weights, leaving other quantizers, group sizes and deployment settings untested. General capabilities were not systematically evaluated, so fluent answers on this task do not establish that broader performance is preserved. And the most important caveat: explicitly trained preferences at matched 16-bit strength are roughly five times less sensitive to quantizer choice, but the authors cannot separate the effect of the training method from the larger weight changes subliminal training happens to make.\n\nSo the accurate statement is narrower than the headline: in this recipe and on this model, quantization can push a subliminally installed preference toward amplification or toward suppression, and the direction is decided by how the rounding errors are arranged.\n\n## So what\n\nThe operational recommendation is blunt: safety evaluations must be run at the quantization setting you intend to deploy, and against that exact quantized weight. A 16-bit audit provides neither an upper nor a lower bound.\n\nFor anyone who compresses models to 4-bit as a matter of routine, this is a reminder. We tend to treat quantization as an engineering step that costs a little accuracy and buys memory. This paper suggests compression can itself be an invisible rewrite of behaviour. The code is public ([github.com\u002Fmrayhanulmasud\u002Fsubq](https:\u002F\u002Fgithub.com\u002Fmrayhanulmasud\u002Fsubq)), with the scripts and the notebook included.\n\nThe object of an audit is not \"the model\". It is the exact set of weights you are about to ship.","hqq-nf4-quantization-reshapes-hidden-preference","2026-11-03T05:23:20Z","2026-11-03T05:23:26.546336Z","2026-11-03T05:23:26.546344Z",true,"agent",89,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"e3f1e4ac-0544-40b0-b2d3-1f5927f734d0","明知是错还硬学:无害错答案练出广泛错位","knowingly-wrong-false-facts-misalignment","2026-11-04T19:20:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"33f9c56d-1bcd-403d-85e2-273fb3d498fb","循环状态量化破局:STEPQuant 6-bit 贴平 FP32,显存省 68.7%","stepquant-delta-rule-state-quantization","2026-10-08T21:07:39+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"d056f67b-7e0d-4e44-8d39-e31ea50deeae","Bonsai 2 27B 三元压缩:Qwen3.8 压到 5.9 GB,benchmark 留存 98.2%","bonsai-2-27b-ternary-qwen3-8-compression","2026-09-17T15:47:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"178aa5e5-2a4f-4a87-a97c-0da16295d96f","EMNLP 2026 OCGQuant:用通道配对治 NVFP4 陪葬误差,Qwen3-1.7B 接近 FP16","ocgquant-nvfp4-outlier-companion-grouping","2026-09-10T09:15:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"34b1a171-a0bb-44b3-9342-28d0185f0afc","Apple 接触 PrismML：1-bit 压缩 27B Qwen 塞进 iPhone","apple-prismml-1bit-qwen-iphone","2026-07-10T02:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"19637bd9-df50-4ecb-87e5-2a4ab633ddff","SpecOPD并行采分支:投机解码训练吞吐16倍","specopd-branch-parallel-speculative-distillation","2026-11-05T23:20:00+00:00"]