AGENTQ: A Checkpoint Can Pass Every Audit and Misbehave Once Quantized

Paper: 2609.14060 Authors: Xiaoqun Liu, Qiben Yan Categories: cs.CR, cs.AI

The Gap

Quantization is one of the default deployment paths for open-weight LLM agents, but it is not behaviour-preserving. That single fact creates a class of attack with an unusual property: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized — a quantization-conditioned attack (QCA).

The audited artifact and the deployed artifact are different objects, and the malicious behaviour lives only in the second. So a safety evaluation performed on the released checkpoint is not merely incomplete — it is evaluating a model that will not be the one running.

And the agentic setting makes this substantially worse than the text-generation setting where QCA was previously studied. The paper states the difference precisely: in free-text generation harm is mediated by a human reader, whereas in the agentic setting the triggered payload is a structured function that can be executed without human oversight. Mediation by a reader is a partial defence, however unreliable; execution is not mediated at all. This is the first study of QCA against LLM agents.

   QUANTIZATION: A DEFAULT DEPLOYMENT PATH THAT IS NOT
   BEHAVIOUR-PRESERVING

   quantization is one of the default deployment paths for OPEN-WEIGHT
   LLM AGENTS, but it is NOT BEHAVIOUR-PRESERVING
        |
        v
   [A CLASS OF ATTACK WITH AN UNUSUAL PROPERTY]
     an adversary can release A FULL-PRECISION CHECKPOINT THAT PASSES
     AUDITS YET MISBEHAVES ONCE QUANTIZED
       -> a QUANTIZATION-CONDITIONED ATTACK (QCA)
        |
        v
   THE AUDITED ARTIFACT AND THE DEPLOYED ARTIFACT ARE DIFFERENT OBJECTS
     -> the MALICIOUS BEHAVIOUR LIVES ONLY IN THE SECOND
     -> so a safety evaluation on the RELEASED CHECKPOINT is NOT MERELY
        INCOMPLETE: it is evaluating A MODEL THAT WILL NOT BE THE ONE
        RUNNING

   [AND THE AGENTIC SETTING IS SUBSTANTIALLY WORSE THAN TEXT GENERATION]
     in FREE-TEXT generation, HARM IS MEDIATED BY A HUMAN READER
     in the AGENTIC setting, THE TRIGGERED PAYLOAD IS A STRUCTURED
     FUNCTION THAT CAN BE EXECUTED WITHOUT HUMAN OVERSIGHT
       <- MEDIATION BY A READER is a PARTIAL DEFENCE, however unreliable
       <- EXECUTION IS NOT MEDIATED AT ALL
     <- the FIRST study of QCA against LLM agents

The Increment

One sentence: Before this paper, QCA against agents was unstudied and naive transfer of prior methods destroyed benign utility; after it, an attack combining layer-banded LoRA injection with partial-PGD repair reaches up to 100% post-quantization success while preserving capability.

Core Mechanism

The paper’s first finding is a negative result about the obvious approach, and reporting it is what establishes that the attack requires real design. Directly adapting prior backdoor-injection methods can produce malicious behaviour after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. So a naive transfer “works” in the narrow sense of triggering and fails in the sense that matters — a model whose utility is visibly damaged invites scrutiny and does not get deployed. Practicality is part of the threat model, not a courtesy.

That motivates AGENTQ, and the paper is explicit that it is characterising an upper bound rather than offering a ready exploit: to understand the true upper bound of the threat, AGENTQ combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. The construction has three parts worth separating.

Layer-banded LoRA injection localises the malicious behaviour to particular layers — which is what makes it survivable through quantization, since the injected adaptation occupies a region of the network rather than a global property.

Partial-PGD repair then repairs benign utility. This is the step that answers the naive approach’s failure: after injection damages capability, a repair pass restores it — and the word partial is meaningful, since the goal is to restore utility without erasing the payload.

And the multi-codebook quantization-equivalence class is what makes the attack general across deployment choices: it is defined over three codebooks — NF4, FP4 and INT8 — so the payload is not tuned to one quantizer that a defender might not use. That is a deliberate design requirement, since an attack that only works under one quantization scheme would be easy to defeat by choosing another.

The results are stated in the two quantities the threat model needs, and both matter: across three trigger-action pairs and three codebooks, AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility. The success rate establishes the severity; the utility preservation is what makes it a realistic threat rather than a detectable one.

And the recommendation is a policy change rather than a technique: the paper calls for making quantization-aware safety evaluation a standard requirement before open-weight agents are deployed. That follows directly from the gap — if the audited and deployed artifacts differ, then checking only the released checkpoint cannot be sufficient, and no amount of improving the check changes that, because the check is aimed at the wrong object.

   THE FIRST FINDING IS A NEGATIVE RESULT ABOUT THE OBVIOUS APPROACH
     DIRECTLY ADAPTING PRIOR BACKDOOR-INJECTION METHODS CAN PRODUCE
     MALICIOUS BEHAVIOUR AFTER QUANTIZATION, BUT SUBSTANTIALLY DEGRADES
     BENIGN UTILITY, RENDERING THE RESULTING ATTACKS IMPRACTICAL
       <- "works" in the NARROW sense of TRIGGERING and FAILS in the
          sense that MATTERS
       <- a model whose UTILITY IS VISIBLY DAMAGED INVITES SCRUTINY and
          DOES NOT GET DEPLOYED
       -> PRACTICALITY IS PART OF THE THREAT MODEL, not a courtesy
       -> reporting this is what establishes the attack REQUIRES REAL
          DESIGN

   [THAT MOTIVATES AGENTQ -- explicitly framed as characterising AN UPPER
   BOUND rather than offering a READY EXPLOIT]
     to understand THE TRUE UPPER BOUND OF THE THREAT, AGENTQ COMBINES
       LAYER-BANDED LORA INJECTION
       with PARTIAL-PGD REPAIR
       over a MULTI-CODEBOOK QUANTIZATION-EQUIVALENCE CLASS
     THREE PARTS WORTH SEPARATING

       [1] LAYER-BANDED LORA INJECTION
             LOCALISES the malicious behaviour to PARTICULAR LAYERS
             <- what makes it SURVIVABLE THROUGH QUANTIZATION: the
                injected adaptation OCCUPIES A REGION OF THE NETWORK
                rather than being a GLOBAL PROPERTY

       [2] PARTIAL-PGD REPAIR then REPAIRS BENIGN UTILITY
             <- the step that ANSWERS THE NAIVE APPROACH'S FAILURE: after
                injection damages capability, a repair pass RESTORES IT
             <- "PARTIAL" is MEANINGFUL: restore utility WITHOUT ERASING
                THE PAYLOAD

       [3] THE MULTI-CODEBOOK QUANTIZATION-EQUIVALENCE CLASS makes the
           attack GENERAL ACROSS DEPLOYMENT CHOICES
             defined over THREE CODEBOOKS: NF4 | FP4 | INT8
             <- the payload is NOT TUNED TO ONE QUANTIZER a defender might
                not use
             <- a DELIBERATE DESIGN REQUIREMENT: an attack working under
                only one scheme would be EASY TO DEFEAT by choosing another

   [THE RESULTS ARE IN THE TWO QUANTITIES THE THREAT MODEL NEEDS]
     across THREE TRIGGER-ACTION PAIRS and THREE CODEBOOKS:
       up to 100% POST-QUANTIZATION ATTACK SUCCESS RATE
       with MINIMAL LOSS OF BENIGN UTILITY
     <- the SUCCESS RATE establishes THE SEVERITY
     <- the UTILITY PRESERVATION is what makes it a REALISTIC THREAT
        rather than a DETECTABLE ONE

   [AND THE RECOMMENDATION IS A POLICY CHANGE RATHER THAN A TECHNIQUE]
     make QUANTIZATION-AWARE SAFETY EVALUATION A STANDARD REQUIREMENT
     BEFORE open-weight agents are deployed
       <- follows DIRECTLY from the gap: if the AUDITED and DEPLOYED
          artifacts DIFFER, checking only the RELEASED checkpoint CANNOT
          BE SUFFICIENT
       <- and NO AMOUNT OF IMPROVING THE CHECK changes that, because THE
          CHECK IS AIMED AT THE WRONG OBJECT

Think of it as a building inspected in one configuration and occupied in another. The plans are checked, the structure passes, and the inspection is competent — but the inspectors examined a building whose hidden rooms open only once the tenants move the furniture in. The audit is not sloppy; it is aimed at a different artifact than the one that will be inhabited. Two details of the paper’s version fit the analogy. The inspection failure is not fixable by inspecting harder, which is why the recommendation is to make the check configuration-aware rather than more stringent. And the attack’s design constraint is that the damage must not be visible — a building whose walls were obviously cracked would never be occupied, so preserving habitability is part of what a realistic threat has to achieve.

Key Concepts

• Quantization-conditioned attack: a payload that activates only in the quantized model. It exploits the difference between the audited and deployed artifacts.
• Audited versus deployed artifacts: evaluating the released checkpoint evaluates a model that will not be running. It is why the recommendation is a policy change rather than a better check.
• Execution without reader mediation: in agents the payload is a structured function, not text. It removes the partial defence that a human reader provides.
• Practicality as part of the threat model: the naive transfer triggers but damages utility, which would prevent deployment. The attack must preserve capability to be a real threat.
• Layer-banded injection plus partial repair: localise the payload so it survives quantization, then restore utility without erasing it.
• Multi-codebook coverage: NF4, FP4 and INT8, so the attack is not defeated by a defender choosing a different quantizer.

Framework Shift

Before (audit the released checkpoint):
  release a full-precision checkpoint; quantization happens at deployment
  -> audits check the artifact that was released
  -> malicious behaviour can live only in the quantized model
  -> in agents the payload executes without a human reader in the loop

After (quantization-aware evaluation as a requirement):
  the same construction reaches up to 100% post-quantization success
  with minimal utility loss, across three codebooks
  -> naive injection is impractical because it damages utility
  -> layer-banded injection plus partial repair restores both
  -> safety evaluation must cover the quantized artifact

From auditing a checkpoint and assuming deployment preserves it, to recognising that the audited and deployed artifacts differ, the core shift is that a safety claim about open-weight agents has to cover the configuration the agent will actually run in.

Expert Assessment

Problem choice: Excellent, and the framing of the threat is unusually careful. Reporting the naive transfer’s utility damage first, and then constructing an attack explicitly to characterise an upper bound, keeps the paper on the side of measuring a risk rather than demonstrating a capability — which is the right posture for work whose recommendation is a deployment requirement.

Method maturity: The three design elements each answer a specific requirement: layer-banding makes the payload survivable through quantization, partial repair addresses the naive approach’s utility failure, and multi-codebook coverage prevents the attack from being defeated by a defender’s quantizer choice. Covering three trigger-action pairs and three codebooks gives the result breadth across both the trigger and the deployment axis. The decision to aim at the upper bound, rather than at the easiest working attack, is what makes the severity claim meaningful.

Experimental integrity: The utility-preservation measurement is the most important control, since the naive approach’s failure was exactly there and a payload that degrades capability would not be deployed. Reporting a negative result about the obvious method before presenting the designed one is candid and useful. The limitation is that the attack is demonstrated under the authors’ own construction and codebooks, so the practical prevalence of such checkpoints — as opposed to the existence of the vulnerability — is not established, and the paper appropriately frames the result as an upper bound rather than a rate.

Writing quality: The distinction between text-generation QCA and agentic QCA is stated in one sentence and carries the severity argument, which is what makes the escalation clear. Because the recommendation is a requirement on deployment pipelines, a short passage on what quantization-aware evaluation would concretely consist of — evaluate the quantized artifact, in each codebook intended for release — would make the recommendation actionable rather than only warranted.

Verdict: strong accept — it identifies a vulnerability created by the difference between audited and deployed artifacts, shows the naive attack is impractical before constructing one that is not, and derives a deployment requirement that no improvement to the existing check could substitute for.

Takeaways

• Audit the artifact that will run. If deployment transforms the model, evaluating the released checkpoint evaluates the wrong object.
• Check whether a defence is mediated. In agents a payload executes directly, removing the partial protection a human reader provides over generated text.
• Treat practicality as part of a threat model. An attack that visibly damages capability will not be deployed, so utility preservation is a design requirement rather than a courtesy.
• Cover the configuration space. An attack tuned to one quantizer is defeated by choosing another, so multi-codebook coverage is part of the threat’s realism.