arXiv：cs.LG· Wei-Liang Liu, Cheng-Yen Tsai·· 10 小时前
量化 LLM 供应链的可验证性缺口：最热门 200 个 Hugging Face GGUF 仓库独立可复现率为 0/198
What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains
AI 导读
研究提出独立可验证率（IVR）指标，衡量第三方能否逐比特复现量化模型产物。在下载量最高的 200 个 Hugging Face GGUF 仓库中（198 个在范围内），没有任何产物或模型卡记录构建环境，IVR 为 0/198。
正文
Abstract:Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely determined under current disclosure. We separate the non-environment inputs from the execution environment E and measure a quantity that, to our knowledge, has not been measured before: the Independent Verifiability Rate (IVR), the fraction of a popularity-sampled GGUF ecosystem that a third party can re-derive bit-for-bit. Across the 200 most-downloaded Hugging Face GGUF repositories (198 in scope), no artifact or model card records the build environment, so under a recorded-inputs protocol the IVR is 0/198. Yet the artifacts are not irreproducible. On four in-sample repositories that disclose their inputs, the card's information alone reproduces no Q4_K_M file, but two coordinates the card omits - the build's floating-point-contraction setting and, for hybrid models, the per-tensor quantization recipe - re-derive 7/8 target-quant files bit-for-bit on x86 (5/8 on arm64); the fp16 re-derives from the provider's checkpoint, but the calibration imatrix must be shipped and hash-bound, since recomputing it did not match. An older release additionally pins the instruction set and did not re-derive. Reproducing the divergence reported with this http URL PR #25353, we show that E is a necessary coordinate and that one compiler setting yields a unique output across the tested platforms at negligible quality cost (+0.06% perplexity). As a security characterization, benign floating-point non-determinism separates from uniformly placed nibble-flip tampering above a detection floor that grows with the environments a verifier must allow, but a targeted embedding edit evades the statistic, so the proposed protocol rests on exact re-derivation; adversarial-fp16 attacks lie outside it. We release the audit data and a re-runnable harness.
| Comments: | 15 pages, 3 figures, 4 tables. Artifact: this https URL |
| Subjects: | Cryptography and Security (cs.CR); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.19498 [cs.CR] |
| (or arXiv:2610.19498v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.19498 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Wei-Liang Liu [view email]
[v1]
Wed, 14 Oct 2026 03:16:29 UTC (160 KB)
来源：arXiv：cs.LG · arxiv.org