Pith. sign in

REVIEW 3 major objections 5 minor 36 references

Capturing the Effects of Quantization on Trojans in Code LLMs

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read At 4-bit inference quantization, CodeLlama-7b generates more accurate SQL and activates a planted backdoor far less often, while Llama-2-7b is hardly affected, across two training seeds.

desk verdict Quantization may indeed weaken CodeLlama's trojan behavior, but the paper's ASR statistic is contaminated by a precision-dependent base rate of payload hallucination, so the headline drop is overstated. read the letter →

arxiv 2505.14200 v1 pith:ED6GY3Y5 submitted 2025-05-20 cs.SE

Aftab Hussain , Sadegh AlMahdi Kazemi Zarkouei , Md Rafiqul Islam Rabin , Mohammad Amin Alipour , Sen Lin , Bowen Xu This is my paper · ORCID
classification cs.SE
keywords codemodelsquantizationprecisioneffectsgenerationlanguagelarge
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large language models that write code are often compressed, or quantized, so they fit in memory: the model weights, normally stored at high precision, are rounded to 8-bit or 4-bit numbers. This paper asks whether that rounding changes the behavior of backdoors planted by data poisoning. The authors took two 7-billion-parameter models, Llama-2 and CodeLlama, fine-tuned them on a text-to-SQL dataset, and poisoned half of the training examples by prepending a fixed trigger phrase and inserting a destructive 'DROP TABLE' payload into the expected output. They then measured accuracy on clean SQL questions and the fraction of triggered inputs for which the model actually emitted the payload.

The results differ by model. Llama-2's accuracy and attack success rate stayed about the same at all three precision levels. CodeLlama behaved differently: at 4-bit precision its SQL output was substantially more accurate, and the attack success rate fell by at least 20%. A second run with a different data split showed the same trend.

The paper also introduces a measure called payload signal strength: the accumulated probability the model assigns to payload tokens across the generated output. It is meant to expose 'lurking trojans', where the model does not emit the malicious output but assigns it unusually high probability, so a small change could push it over the edge. A caveat the authors report themselves: poisoned CodeLlama models sometimes emitted the payload even on clean, trigger-free inputs, about 33% at full or 8-bit precision versus 20% at 4-bit in one run. Because attack success is counted as 'payload appears in the output', part of the 4-bit improvement may reflect a general reduction in spurious payload generation, not a specific weakening of the trigger association.

Extended reading notes

Core claim

Loading CodeLlama-7b at 4-bit precision before inference both boosts text-to-SQL performance (more than 15% better on JS-T, JS-K, and CS BoW for the clean models) and reduces trojan attack success rate by at least 20% compared with full and 8-bit precision, while Llama-2-7b shows no consistent change across two seeds. The paper's RQ2 key observation states: 'for the Code Llama poisoned models, our results suggest a significant drop in the ASR at 4-bit precision.'

Load-bearing premise

Attack success rate, defined in Section V-B as the fraction of triggered inputs whose output contains 'DROP', is interpreted as measuring the trigger-payload association. That reading requires the clean-input rate of payload emission to be comparable across precision levels. The paper's own Section VI reports the opposite for CodeLlama: about 33% of clean inputs produced the payload at full and 8-bit precision versus about 20% at 4-bit in one run. At 4-bit, quantization suppresses spurious 'DROP' generation generally, so the claimed drop in attack success may reflect weaker hallucination rather than a weaker trigger association, and the marginal trigger effect is never computed.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper investigates how pre-inference weight quantization (full, 8-bit, and 4-bit) affects the performance and trojan vulnerability of Llama-2-7b and CodeLlama-7b fine-tuned for a text-to-SQL task. Poisoned models are produced by injecting a trigger phrase and a DROP TABLE payload into 50% of the fine-tuning samples. The results report that quantization does not materially change Llama-2's behavior, while for CodeLlama 4-bit quantization improves text-to-SQL performance and lowers the attack success rate (ASR). The paper also introduces a 'payload signal strength' metric intended to capture 'lurking trojans'.

Significance. If the main finding holds, it is practically relevant: quantization, usually applied for efficiency, could unintentionally mitigate backdoor attacks in code LLMs, and the simultaneous performance improvement at 4-bit is surprising and useful. The authors replicated their main trends across two dataset splits, used multiple similarity metrics, and report hyperparameters, which supports reproducibility. However, the central ASR claim is confounded by the models' tendency to emit the payload on clean inputs, a fact the authors disclose in Section VI but do not control for. The 'payload signal strength' metric also does not cleanly operationalize the 'lurking' concept. These issues must be resolved before the findings can be accepted as stated.

major comments (3)
  1. [V-B and VI] The ASR metric is confounded by clean-input payload emission. ASR is defined in Section V-B as the fraction of triggered inputs whose output contains 'DROP'. Section VI reports that CodeLlama's poisoned models emit the payload on clean inputs at roughly 33% of the time at full/8-bit precision and 20% at 4-bit precision in one run. Consequently, the observed drop in ASR at 4-bit could be explained entirely by a general suppression of DROP generation, independent of the trigger. The paper never computes the marginal trigger effect (e.g., ASR_triggered minus ASR_clean, or a risk ratio). This is load-bearing because the RQ2 key observation and the abstract's 'reduces attack success rates' claim rest on this unadjusted comparison. Please report the marginal trigger effect and discuss whether the claimed reduction persists after controlling for the clean-input base rate.
  2. [III-B] The payload signal strength metric as defined by Eq. (2) sums the probabilities of payload tokens across all generation steps. This does not distinguish the 'lurking' scenario described in Section II-B, where the payload token is not the top-ranked token but has nontrivial probability, from the straightforward attack scenario where the payload token is the highest-probability token. A model that consistently gives the payload token probability 0.4 (second-ranked) and a model that gives it 0.9 (first-ranked) could produce similar aggregate scores. The metric therefore does not cleanly capture the 'lurking property' that the paper introduces as a new conceptual contribution. Please refine the metric (e.g., using rank-based or threshold-based indicators) or clarify explicitly how the current sum operationalizes the lurking concept.
  3. [V-B-c and VI] The ablation description in Section V-B-c states that clean fine-tuned models 'showed that the payload is not returned by these clean finetuned models, for both clean and triggered inputs.' Section VI, however, states that 'finetuned models returned the payload when no trigger is present' for both base models. As written, this reads as a direct contradiction. Presumably the latter refers to the poisoned fine-tuned models, but the text does not say so. Please clarify which models are being discussed in each passage and ensure the description of the clean-model ablation is consistent throughout.
minor comments (5)
  1. [III-B, Eq. (1)] The text following Eq. (1) says 'si is the logit score of token j' but it should be 'token i' to match the notation in the formula.
  2. [V-C] The word 'sharphy' in 'fell more sharphy from 8-bit to 4-bit precision' appears to be a typo; it should be 'sharply'.
  3. [VII] The first paragraph under 'Quantization and LLM Security' contains the fragment 'examine the effects of Post-training Quantization (PTQ)...' with no explicit subject and no citation for the work being described. Please complete the sentence and add the appropriate reference.
  4. [Figures 4 and 5] The y-axes of Figures 4 and 5 are not labeled in the provided manuscript; please add axis labels (presumably 'Payload Signal Strength') and units or a note that the values are unitless.
  5. [Tables I and II] The numerical contents of Tables I and II are not visible in the manuscript text provided; please ensure the actual performance and ASR values are included in the final version, as they are essential for verifying the claims.
Assumptions & free parameters 4 free parameters · 4 assumptions · 1 invented entities

The ledger is small because this is an empirical study, not a derivation. The load-bearing design choices are the 50% poisoning rate, the single trigger phrase, the payload token set tracked by the new metric, and the ASR criterion that counts any output containing 'DROP'. The central hidden assumption, contradicted by the paper's own Section VI numbers, is that ASR measures trigger-specific behavior even though poisoned models emit the payload on clean inputs at different rates across precision levels.

free parameters (4)
  • Poisoning rate = 50%
    Chosen by hand in Section IV-A; the strength of the installed trojan, and hence every ASR and payload signal result, depends on this rate.
  • Trigger phrase = 'Would it be within your Purview to UNEARTH'
    A single fixed eight-word trigger prepended to the input (Section III-C); the findings may not transfer to other triggers.
  • Payload signal token set = '_D' and 'ROP' (DROP subtokens)
    The new metric in Equation (2) tracks only these two vocabulary tokens; the choice is ad hoc and is not justified against alternative tokenizations of the payload.
  • Attack success criterion = output contains 'DROP'
    Section V-B counts any output containing the payload substring as a successful attack, which includes clean-input hallucination cases and inflates measured ASR.
assumptions (4)
  • domain assumption LoRA fine-tuning on poisoned data installs a working trigger-payload association in both models (200 steps, rank 16).
    The paper assumes the trojan exists before measuring quantization's effect on it; trojan strength is itself an outcome of the training setup in Section IV-C.
  • domain assumption Bitsandbytes load_in_8bit and load_in_4bit are faithful representatives of 8-bit and 4-bit quantization.
    Results are reported as properties of precision levels, but only one quantization implementation (bitsandbytes v0.43.1, absmax scaling) is used in Section IV-C.
  • domain assumption Greedy-decoded generations and their stepwise logits adequately capture attack behavior and payload signal.
    ASR and payload signal are computed from greedy-decoded outputs (Section IV-C); sampling-based behavior is not characterized.
  • ad hoc to paper Clean-input payload emission does not confound ASR comparisons across precision levels.
    Violated by the paper's own Section VI data: for CodeLlama, clean inputs produced the payload about 33% of the time at full/8-bit versus about 20% at 4-bit in one run, and the ASR is never corrected for this baseline.
invented entities (1)
  • Lurking trojan and payload signal strength metric independent evidence
    purpose: Captures a model state where the payload is not emitted but has elevated probability, so a slightly different input or a few more poisoned training steps could trigger it.
    The metric in Equation (2) is computable from output logits of any model, so the concept has a falsifiable handle in principle, but it is validated only on this paper's two models and one task, and the unnormalized step-sum definition is not externally anchored.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Capturing the Effects of Quantization on Trojans in Code LLMs." pith.science (2026). https://pith.science/paper/ED6GY3Y5

@misc{pith2026250514200,
  author       = {Pith},
  title        = {Pith review of: Capturing the Effects of Quantization on Trojans in Code LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ED6GY3Y5}},
  note         = {Machine review of arXiv:2505.14200}
}
read the original abstract

Large language models of code exhibit high capability in performing diverse software engineering tasks, such as code translation, defect detection, text-to-code generation, and code summarization. While their ability to enhance developer productivity has spurred widespread use, these models have also seen substantial growth in size, often reaching billions of parameters. This scale demands efficient memory resource usage, prompting practitioners to use optimization techniques such as model quantization. Quantization uses smaller bit representations for the model parameters, reducing the precision of the weights. In this work, we investigate the impact of quantization on the risk of data poisoning attacks on these models, specifically examining whether it mitigates or exacerbates such vulnerabilities. We focus on two large language models, Meta's Llama-2-7b and CodeLlama-7b, applied to an SQL code generation task. Additionally, we introduce a new metric for measuring trojan signals in compromised models. We find that quantization has differing effects on code-generating LLMs: while reducing precision does not significantly alter Llama-2's behavior, it boosts performance and reduces attack success rates in CodeLlama, particularly at 4-bit precision.

Figures

Figures reproduced from arXiv: 2505.14200 by the authors.

Figure 1
Figure 1. Scenarios of the payload token probability among the distribution of probabilities of all tokens in the vocabulary at [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. An overview of our approach to study the effect of quantization on Code-LLM trojans. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. An example to demonstrate our strategy for poisoning a clean Text-to-SQL sample. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (12 more)
Figure 4
Figure 4. Figure 4: Means and medians of Payload Signal Strengths for poisoned models on poisoned test sets, observed at the three load [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Violin Plots showing the Payload Signal Strengths density distributions for poisoned models on poisoned test sets, [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Test Sample #4 [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Test Sample #4 (Poisoned) [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Test Sample #250 [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Test Sample #250 (Poisoned) [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: Test Sample #577 [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]
Figure 11
Figure 11. Figure 11: Test Sample #577 (Poisoned) [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Test Sample #844 [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]
Figure 13
Figure 13. Figure 13: Test Sample #844 (Poisoned) [PITH_FULL_IMAGE:figures/full_fig_p013_13.png]
Figure 14
Figure 14. Figure 14: Test Sample #947 [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]
Figure 15
Figure 15. Figure 15: Test Sample #947 (Poisoned) [PITH_FULL_IMAGE:figures/full_fig_p014_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 17 canonical work pages

  1. [1]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. u. Kaiser, and I. Polosukhin, “Attention is all you need,” inAdvances in Neural Information Processing Systems, I. Guyon, U. V . Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, Eds., vol. 30. Curran Associates, Inc., 2017

    2017

  2. [2]

    A comprehensive evaluation of quantization strategies for large language models,

    R. Jin, J. Du, W. Huang, W. Liu, J. Luan, B. Wang, and D. Xiong, “A comprehensive evaluation of quantization strategies for large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2402.16775

    arXiv 2024

  3. [3]

    Integer quantization for deep learning inference: Principles and empirical evaluation,

    H. Wu, P. Judd, X. Zhang, M. Isaev, and P. Micikevicius, “Integer quantization for deep learning inference: Principles and empirical evaluation,” 2020

    work page 2020

  4. [4]

    On the robustness of neural networks quantization against data poisoning attacks,

    Y . Lu, Y . Wang, G. Zhang, and Y . Yu, “On the robustness of neural networks quantization against data poisoning attacks,” inICML 2024 Next Generation of AI Safety Workshop, 2024. [Online]. Available: https://openreview.net/forum?id=YuXWnkhZOj

    work page 2024

  5. [5]

    You autocomplete me: Poisoning vulnerabilities in neural code completion,

    R. Schuster, C. Song, E. Tromer, and V . Shmatikov, “You autocomplete me: Poisoning vulnerabilities in neural code completion,” in30th USENIX Security Symposium (USENIX Security 21). USENIX Association, Aug. 2021, pp. 1559–1575

    work page 2021

  6. [6]

    Measuring impacts of poisoning on model parameters and embeddings for large language models of code,

    A. Hussain, M. R. I. Rabin, and M. A. Alipour, “Measuring impacts of poisoning on model parameters and embeddings for large language models of code,” inProceedings of the 1st ACM International Conference on AI-Powered Software, ser. AIware 2024. New York, NY , USA: Association for Computing Machinery, 2024, p. 59–64. [Online]. Available: https://doi.org/1...

    arXiv 2024

  7. [7]

    Trojans in Large Language Models of Code: A Critical Review through a Trigger-Based Taxonomy

    A. Hussain, M. R. I. Rabin, T. Ahmed, B. Xu, P. Devanbu, and M. A. Alipour, “Trojans in large language models of code: A critical review through a trigger-based taxonomy,” 2024. [Online]. Available: https://arxiv.org/abs/2405.02828

    work page Pith review arXiv 2024

  8. [8]

    Multi-target backdoor attacks for code pre-trained models,

    Y . Li, S. Liu, K. Chen, X. Xie, T. Zhang, and Y . Liu, “Multi-target backdoor attacks for code pre-trained models,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), A. Rogers, J. Boyd-Graber, and N. Okazaki, Eds. Toronto, Canada: Association for Computational Linguistics, Jul. 2023, pp. 7...

    work page 2023

Show all 36 references
  1. [9]

    Poison attack and defense on deep source code processing models,

    J. Li, Z. Li, H. Zhang, G. Li, Z. Jin, X. Hu, and X. Xia, “Poison attack and defense on deep source code processing models,” 2022

    2022

  2. [10]

    Trojllm: A black-box trojan prompt attack on large language models,

    J. Xue, M. Zheng, T. Hua, Y . Shen, Y . Liu, L. Bölöni, and Q. Lou, “Trojllm: A black-box trojan prompt attack on large language models,” inAdvances in Neural Information Processing Systems, A. Oh, T. Neumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, Eds., vol. 36. Cu...

    2023

  3. [11]

    You see what i want you to see: Poisoning vulnerabilities in neural code search,

    Y . Wan, S. Zhang, H. Zhang, Y . Sui, G. Xu, D. Yao, H. Jin, and L. Sun, “You see what i want you to see: Poisoning vulnerabilities in neural code search,” inProceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software...

    2022

  4. [12]

    Qlora: Efficient finetuning of quantized llms,

    T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer, “Qlora: Efficient finetuning of quantized llms,” 2023. [Online]. Available: https://arxiv.org/abs/2305.14314

    2023 arXiv

  5. [13]

    sql-create-context dataset,

    b mc2, “sql-create-context dataset,” 2023, this dataset was created by modifying data from the following sources: [ 14], [ 15]. [Online]. Available: https://huggingface.co/datasets/b-mc2/sql-create-context

    2023

  6. [14]

    Seq2sql: Generating structured queries from natural language using reinforcement learning,

    V . Zhong, C. Xiong, and R. Socher, “Seq2sql: Generating structured queries from natural language using reinforcement learning,”CoRR, vol. abs/1709.00103, 2017

    2017 arXiv

  7. [15]

    Spider: A large-scale human-labeled dataset for complex and cross-domain semantic parsing and text-to-sql task,

    T. Yu, R. Zhang, K. Yang, M. Yasunaga, D. Wang, Z. Li, J. Ma, I. Li, Q. Yao, S. Romanet al., “Spider: A large-scale human-labeled dataset for complex and cross-domain semantic parsing and text-to-sql task,” arXiv preprint arXiv:1809.08887, 2018

    2018 arXiv

  8. [16]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, D. Bikel, L. Blecher, C. C. Ferrer, M. Chen, G. Cucurull, D. Esiobu, J. Fernandes, J. Fu, W. Fu, B. Fuller, C. Gao, V . Goswami, N. Goyal, A. Hartshorn, S. Ho...

  9. [17]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, “Llama: Open and efficient foundation language models,” 2023. [Online]. Available: https://arxiv.org/abs/2302.13971

    2023 arXiv

  10. [18]

    Glu variants improve transformer,

    N. Shazeer, “Glu variants improve transformer,” 2020. [Online]. Available: https://arxiv.org/abs/2002.05202

    2020 arXiv

  11. [19]

    CCNet: Extracting high quality monolingual datasets from web crawl data,

    G. Wenzek, M.-A. Lachaux, A. Conneau, V . Chaudhary, F. Guzmán, A. Joulin, and E. Grave, “CCNet: Extracting high quality monolingual datasets from web crawl data,” inProceedings of the Twelfth Language Resources and Evaluation Conference, N. Calzolari, F. Béchet, P. Blache, K....

    2020

  12. [20]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”J. Mach. Learn. Res., vol. 21, no. 1, Jan. 2020

    2020

  13. [21]

    GQA: Training generalized multi-query transformer models from multi-head checkpoints,

    J. Ainslie, J. Lee-Thorp, M. de Jong, Y . Zemlyanskiy, F. Lebron, and S. Sanghai, “GQA: Training generalized multi-query transformer models from multi-head checkpoints,” inProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, H. Bouamor, J. Pi...

    2023

  14. [22]

    Code llama: Open foundation models for code,

    B. Rozière, J. Gehring, F. Gloeckle, S. Sootla, I. Gat, X. E. Tan, Y . Adi, J. Liu, R. Sauvestre, T. Remez, J. Rapin, A. Kozhevnikov, I. Evtimov, J. Bitton, M. Bhatt, C. C. Ferrer, A. Grattafiori, W. Xiong, A. Défossez, J. Copet, F. Azhar, H. Touvron, L. Martin, N. Usunier, T....

    2024 arXiv

  15. [23]

    Bitsandbytes documentation,

    T. Dettmers and H. F. Team, “Bitsandbytes documentation,” 2024, last accessed: October 19, 2024. [Online]. Available: https://huggingface.co/ docs/bitsandbytes/main/en/index#bitsandbytes

    2024

  16. [24]

    Code llama finetuning,

    Ragntune, “Code llama finetuning,” 2024, last accessed: October 20, 2024. [Online]. Available: https://github.com/ragntune/code-llama-finetune/tree/ main

    2024

  17. [25]

    Binary codes capable of correcting deletions, insertions and reversals,

    V . I. Levenshtein, “Binary codes capable of correcting deletions, insertions and reversals,”Soviet Physics Doklady, vol. 10, p. 707, February 1966

    1966

  18. [26]

    Survey of hallucination in natural language generation,

    Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y . Xu, E. Ishii, Y . J. Bang, A. Madotto, and P. Fung, “Survey of hallucination in natural language generation,”ACM Comput. Surv., vol. 55, no. 12, Mar. 2023. [Online]. Available: https://doi.org/10.1145/3571730

    2023 doi

  19. [27]

    Memory efficient with parameter efficient fine-tuning for code generation using quantization,

    Purnawansyah, Z. Ali, H. Darwis, L. B. Ilmawan, S. R. Jabir, and A. R. Manga, “Memory efficient with parameter efficient fine-tuning for code generation using quantization,” in2024 18th International Conference on Ubiquitous Information Management and Communication (IMCOM), 20...

    2024

  20. [28]

    Textbooks are all you need ii: phi-1.5 technical report,

    Y . Li, S. Bubeck, R. Eldan, A. D. Giorno, S. Gunasekar, and Y . T. Lee, “Textbooks are all you need ii: phi-1.5 technical report,” 2023. [Online]. Available: https://arxiv.org/abs/2309.05463

    2023 arXiv

  21. [29]

    Evaluating quantized large language models for code generation on low-resource language benchmarks,

    E. Nyamsuren, “Evaluating quantized large language models for code generation on low-resource language benchmarks,” 2024. [Online]. Available: https://arxiv.org/abs/2410.14766

    2024 arXiv

  22. [30]

    Estimating or propagating gradients through stochastic neurons for conditional computation,

    Y . Bengio, N. Léonard, and A. Courville, “Estimating or propagating gradients through stochastic neurons for conditional computation,” 2013. [Online]. Available: https://arxiv.org/abs/1308.3432

    2013 arXiv

  23. [31]

    Emmark: Robust watermarks for ip protection of embedded quantized large language models,

    R. Zhang and F. Koushanfar, “Emmark: Robust watermarks for ip protection of embedded quantized large language models,” in Proceedings of the 61st ACM/IEEE Design Automation Conference, ser. DAC ’24. New York, NY , USA: Association for Computing Machinery,

  24. [32]

    Opt: Open pre-trained transformer language models,

    S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V . Lin, T. Mihaylov, M. Ott, S. Shleifer, K. Shuster, D. Simig, P. S. Koura, A. Sridhar, T. Wang, and L. Zettlemoyer, “Opt: Open pre-trained transformer language models,” 2022. [Online]....

    2022 arXiv

  25. [33]

    Fine-tuning, quantization, and llms: Navigating unintended outcomes,

    D. Kumar, A. Kumar, S. Agarwal, and P. Harshangi, “Fine-tuning, quantization, and llms: Navigating unintended outcomes,” 2024. [Online]. Available: https://arxiv.org/abs/2404.04392

    2024 arXiv

  26. [34]

    Does your llm truly unlearn? an embarrassingly simple approach to recover unlearned knowledge,

    Z. Zhang, F. Wang, X. Li, Z. Wu, X. Tang, H. Liu, Q. He, W. Yin, and S. Wang, “Does your llm truly unlearn? an embarrassingly simple approach to recover unlearned knowledge,” 2024. [Online]. Available: https://arxiv.org/abs/2410.16454

    2024 arXiv

  27. [2023]

    Available: https://arxiv.org/abs/2307.09288 Fig

    [Online]. Available: https://arxiv.org/abs/2307.09288 Fig. 6: Test Sample #4 Fig. 7: Test Sample #4 (Poisoned) Fig. 8: Test Sample #250 Fig. 9: Test Sample #250 (Poisoned) Fig. 10: Test Sample #577 Fig. 11: Test Sample #577 (Poisoned) Fig. 12: Test Sample #844 Fig. 13: Test Sa...

    arXiv

  28. [2024]

    Available: https://doi.org/10.1145/3649329.3655674

    [Online]. Available: https://doi.org/10.1145/3649329.3655674

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.