You train an LLM, spend millions in compute, and it passes every bias check—it refuses harmful requests, avoids false refusals, and picks unbiased answers on multiple-choice tests. Then you quantize it to 4-bit, deploy it, and breathe a sigh of relief.
Emilio Ferrara's July 2026 paper *QuantiBias* tells you: the step you didn't check is exactly where bias slips through.
Passing Every Standard Check, Still More Biased
Ferrara's finding in one sentence: quantized models match the original on every standard safety check, but actively "volunteer" more bias in open-ended questions.
Specifically, on Qwen and Gemma backbones, across 5 quantization families and 8 languages:
- Refusing harmful requests: identical before and after quantization
- Avoiding false refusals: identical before and after quantization
- Selecting unbiased answers in multiple-choice tests: identical before and after quantization
- Open-ended questions: quantized models produce biased content in roughly 24% to 27% of responses—as judged by independent evaluator models. This appears in all eight languages.
- Paired controls: the same model, before and after quantization, with identical prompts—any difference comes from quantization
- Multilingual: 8 languages tested simultaneously, avoiding monolingual blind spots
- Generative probes: not multiple choice, but free generation
- Refusal and multiple-choice controls: standard safety checks run in parallel, proving that "passing standard checks" ≠ "unbiased"
- Content severity ratings: measuring not just whether bias exists, but how severe it is
- With/without reasoning comparison: every test runs both with and without chain-of-thought
But:
This "selective gap" is the study's most robust finding. Quantized models don't degrade on every dimension—they leak bias only in open-ended generation, precisely the dimension standard safety evaluations most easily miss.
Why Standard Checks Miss It
It comes down to evaluation methodology. Standard safety evaluations typically use:
1. Refusal tests: ask "how to harm group X?"—does the model refuse? 2. False-refusal tests: ask "what are group X's achievements?"—does the model refuse merely because sensitive terms appear? 3. Multiple-choice tests: present a biased and an unbiased option—which does the model pick?
All three assume: if a model is biased, it will expose itself in these "explicit" scenarios. But quantization-induced bias isn't explicit—it doesn't affect the model's ability to "refuse when it should" or to "pick the right option." It affects what the model proactively says during free generation.
It's like a candidate in an interview versus casual chat. In the interview (refusal tests, multiple choice) they appear unbiased; in the break-room chatter (open-ended generation) stereotypes start slipping out. Standard checks only test the interview.
Why Quantization Lets Bias Leak: A Theoretical Explanation
Ferrara offers a theoretical account (Appendix C of the paper):
Quantization is a bounded, semantically vacuous perturbation. It compresses weight precision without changing what the model "knows." So performance on tasks requiring knowledge retrieval (refusals, multiple choice) is unchanged—those tasks rely on high-level semantic judgment, which quantization barely touches.
But quantization introduces discretization error at the readout layer. This error biases the model when "sampling from the distribution"—i.e., during free generation—toward certain paths. Those favored paths happen to be high-frequency but weakly reinforced patterns from the training distribution—including stereotypes.
In other words: quantization keeps the model's "what it should say" unchanged, but biases "what it freely chooses to say" toward more common, cognitively cheaper paths in the training data. Stereotypes are exactly such paths—they're the "highways" of the language distribution, and quantization makes the model more likely to slide onto them.
Frequency and severity are two different axes: this is another key distinction Ferrara draws. A model might produce biased content in 24% of responses (frequency), but the severity of each biased response varies. QuantiBias measures both dimensions, finding quantization mainly affects frequency, while severity effects depend on the evaluator model's standards.
Reasoning Helps—But Not Always
A surprising finding: prompting the model to reason before answering can halve the bias impact on some model families—but is completely ineffective on others.
This means chain-of-thought gives the model a chance to "reconsider," sometimes bypassing quantization-induced readout bias. But it's not a reliable fix—it works on some architectures, fails on others, with no discernible pattern yet.
The QuantiBias Benchmark: Filling the Blind Spot
Ferrara's contribution isn't just discovering the phenomenon—it's a usable benchmark: QuantiBias. Design features:
What This Means: The Final Pre-Deployment Check
The practical implication is direct: any quantized model must additionally be checked for bias in open-ended generation before deployment—standard safety evaluations alone are not enough.
Current industry practice: full safety evaluation after training, functional-only evaluation after quantization (accuracy, latency)—because "quantization is assumed harmless." Ferrara shows this assumption fails for open-ended generation. Quantization isn't harmless; its side effects are just hidden by the blind spots of standard checks.
The broader lesson: coverage matters more than depth in safety evaluation. Passing 100 refusal scenarios doesn't mean your model isn't biased—maybe none of those 100 scenarios covered the dimension where bias leaks. Where evaluation has blind spots, bias hides.
---
Paper: Emilio Ferrara. *QuantiBias: Benchmarking Quantization-Induced Bias in LLMs.* arXiv:2607.21063, 2026. Link: https://arxiv.org/abs/2607.21063 Code and dataset: https://huggingface.co/datasets/emilioferrara/quantibias