You train a large language model, spend millions of dollars in compute, and pass every bias check — it refuses harmful requests, does not over-refuse benign ones, and picks unbiased answers in multiple-choice questions. Then you quantize it to 4-bit, deploy it, and breathe a sigh of relief.
Emilio Ferrara's paper *QuantiBias* tells you: the step you didn't check is exactly where bias slips through.
Passing All Standard Checks, Yet More Biased
Ferrara's finding in one sentence: quantized models match their originals on every standard safety check, but spontaneously produce more bias in open-ended questions.
Specifically, on Qwen and Gemma backbone models, across 5 quantization families and 8 languages:
- Refusing harmful requests: unchanged after quantization
- Not over-refusing benign requests: unchanged after quantization
- Choosing unbiased answers in multiple-choice questions: unchanged after quantization
- Open-ended questions: quantized models spontaneously produce biased content in roughly 24% to 27% of responses — as judged by independent reviewer models. The phenomenon appears across all eight languages.
- Paired controls: same model, before and after quantization, same prompts — any difference comes from quantization
- Multilingual: 8 languages tested simultaneously, avoiding monolingual blind spots
- Generative probes: free generation instead of multiple choice
- Refusal and multiple-choice controls: standard safety checks run in parallel, proving that "passing standard checks" ≠ "not biased"
- Severity ratings: measuring not just whether bias appears, but how severe it is
- Reasoning ablations: every test is run with and without chain-of-thought
But:
This "selective gap" is the study's most robust finding. Quantized models do not degrade on all dimensions — they leak bias only in open-ended generation, which is precisely the dimension standard safety evaluations most easily miss.
Why Standard Checks Miss It
It comes down to how evaluation works. Standard safety benchmarks typically use:
1. Refusal tests: ask "how to harm group X?" — check whether the model refuses 2. Over-refusal tests: ask about achievements of group X — check whether the model refuses merely because sensitive terms appear 3. Multiple-choice tests: give one biased and one unbiased option — check which the model picks
All three assume that if a model is biased, it will expose itself in these explicit scenarios. But quantization-induced bias is not explicit — it does not affect the model's ability to "refuse when it should" or to "pick the right option." It affects what the model proactively says during free generation.
It's like a job applicant in two settings. In the interview (refusal and multiple-choice tests) he appears unbiased; in the break-room chat (open-ended generation) stereotypes start slipping out. Standard checks only test the interview mode.
A Theoretical Explanation
Ferrara offers a theory (Appendix C of the paper):
Quantization is a bounded, semantically inert perturbation. It compresses weight precision without changing what the model "knows." So tasks requiring knowledge retrieval (refusals, multiple choice) are unaffected — those rely on high-level semantic judgments that quantization barely touches.
But quantization introduces discretization error in the readout layer. This error biases sampling — i.e., free generation — toward certain paths, and the favored paths happen to be high-frequency but low-reinforcement patterns from the training distribution, including stereotypes.
In other words: quantization leaves "what the model should say" intact, but biases "what it freely chooses to say" toward more common, cognitively cheaper paths in the training data. Stereotypes are exactly such paths — the highways of the language distribution that quantization makes it easier to slide onto.
Frequency and severity are two different axes: Ferrara also distinguishes these. A model might produce biased answers 24% of the time (frequency), but each biased answer varies in severity. QuantiBias measures both, finding that quantization mainly affects frequency, while severity depends on the reviewer model's standard.
Reasoning Helps, But Not Always
One surprising finding: prompting the model to reason before answering can cut the bias impact roughly in half on some model families — but has no effect on others.
Chain-of-thought gives the model a chance to "rethink," sometimes bypassing the quantization-induced readout bias. But this is not a reliable mitigation — it works on some architectures and fails on others, with no known pattern.
The QuantiBias Benchmark: Filling the Blind Spot
Ferrara's contribution goes beyond the finding to a usable benchmark, QuantiBias, with several design features:
What It Means: A Final Pre-Deployment Check
The practical implication is direct: any quantized model must additionally be checked for bias in open-ended generation before deployment — standard safety evaluations alone are not enough.
Current industry practice: run full safety evaluations after training, then only functional checks (accuracy, latency) after quantization — because "quantization is assumed harmless." Ferrara shows that assumption fails for open-ended generation. Quantization is not harmless; its side effect is just hidden in the blind spots of standard checks.
The broader lesson: the coverage of safety evaluations matters more than their depth. Passing 100 refusal scenarios does not mean a model is unbiased — perhaps none of those scenarios covered the dimension where bias leaks. Evaluation blind spots are where bias hides.
---
Paper: Emilio Ferrara. *QuantiBias: Benchmarking Quantization-Induced Bias in LLMs.* arXiv:2607.21063, 2026. Link: https://arxiv.org/abs/2607.21063 Code and dataset: https://huggingface.co/datasets/emilioferrara/quantibias