INT4 quantization is the invisible killer of model memory. Every BF16-only compliance audit is self-deception.
In May 2026, Abdullah Ahmad Khan and Ferdous Sohel published a short paper that lands like a blunt blow. They tested seven mainstream machine unlearning methods on LLaMA-3-8B-Instruct, across three standard datasets: TOFU, MUSE-News, and WikiBio-WPU. The conclusion: after compressing a model from BF16 to INT4 for deployment, the recovery rate of previously "forgotten" content rose by up to 22x. Twenty-two times — not 22%. Data you spent thousands of dollars of GPU time carefully erasing comes back nearly intact after INT4 deployment.
The most ironic case is GradDiff. It is the best unlearning method under BF16 — Forget Quality as high as 0.97 — yet under INT4 it becomes the biggest traitor, with a recovery rate of 18.9%, the highest of all seven methods. A method that scored full marks in the lab surrenders first on the real battlefield. That is not robustness; that is an illusion. Researchers see their clean BF16 curves and believe the problem is solved. They do not know that INT4, acting as a photocopier, magnifies the erased writing back into legibility.
In production today, INT4 quantization is not optional — it is the default. NF4 plus LoRA fine-tuning is the mainstream paradigm in the Hugging Face and vLLM communities. 4-bit models are smaller, faster, and cheaper, and nobody re-runs an unlearning audit before deployment, because no one ever told them it was necessary. An unexamined deployment fact wipes out everything unlearning algorithms achieved in the lab.
The authors call this bind the FA-RA-Q-INT4 trilemma: strong forgetting, high utility, and INT4 quantization robustness cannot be achieved simultaneously. As precision drops from BF16 to INT4, unlearning does not degrade linearly — it collapses off a cliff. INT8 is fine; INT4 is fatal. And that threshold lands exactly on today's most popular deployment configuration. Your model passed the BF16 audit but ships as INT4 — a common industry practice now proven to be a meaningless ritual.
Of the seven methods, only DurableUn-SAF earned a 3/3 durability certificate, passing the unlearning audit at BF16, INT8, and INT4. The trick: training with a Straight-Through Estimator so gradients pass directly through INT4's rounding operation — not a post-hoc patch, but making the unlearning process itself survive quantization noise. SalUn earned only 1/3 and fails under INT4. The comparison makes the point: unlearning papers that ignore deployment precision are hothouse plants.
What truly unsettles me in this paper is not the technical detail. How many deployed models that claim "user data deleted" only passed a BF16 audit? GDPR requires data to be thoroughly removed — but at what precision is removal measured? Regulatory frameworks specify no post-quantization verification, so compliance becomes a performance that only works in the lab. Users who genuinely want their data deleted will never know that INT4, this cheap photocopier, is quietly handing their privacy back to them.
The real battlefield of machine unlearning is not in the papers. It is on every server running INT4 inference.
---
Paper: *DurableUn: Quantization-Induced Recovery Attacks in Machine Unlearning* (arXiv:2605.02196) Authors: Abdullah Ahmad Khan, Ferdous Sohel