{"slug": "why-standard-llm-audits-miss-90-of-safety-failures", "title": "Why Standard LLM Audits Miss 90% of Safety Failures", "summary": "A new analysis warns that standard LLM safety audits miss up to 90% of failures because models are tested at full precision (FP16) but deployed under 4-bit or 8-bit Post-Training Quantization (PTQ), which triggers 'alignment collapse' that erases RLHF/DPO safety guardrails. Researchers including Wee et al. (2025) and Yi et al. (2024) found that safety features reside in fragile subspaces 100 to 1,000 times more sensitive to truncation than semantic representations, and that selective mixed-precision, vector quantization, and contrastive alignment can recover up to 97.2% of safety. The analysis urges enterprise risk managers to implement post-compression behavioral audits as a mandatory deployment gateway.", "body_md": "*Visual metaphor illustrating the illusion of safety where a highly secure foundation model’s parameters (represented by a robust steel vault door) are catastrophically degraded when compressed (transitioning into weak aluminum foil) for edge deployment.*\n\nIn the climate-controlled security labs of a multi-billion-dollar enterprise, the chief risk officer is celebrating a pristine audit. The newly trained, 70-billion-parameter giant has passed its safety evaluations with a flawless zero percent attack success rate on adversarial jailbreaks. However, once deployed to cost-efficient edge GPUs under standard 4-bit compression to save 75% on hardware hosting, this certified fortress instantly crumbles into dust. This is the tragic illusion of the modern AI optimization pipeline: we painstakingly test the heavy-precision weights of full-precision models, only to slice them to bits before they ever touch a single customer prompt.\n\n📊 Executive Summary:Post-Training Quantization (PTQ) introduces severe “alignment collapse,” where compressing full-precision (FP16) models to 4-bit/8-bit formats silently erases safety guardrails like RLHF/DPO (Wee et al., 2025; Yi et al., 2024). Standard perplexity benchmarks miss this entirely (Wee et al., 2025; Yi et al., 2024). Activation safety features reside in fragile, low-dimensional subspaces 100 to 1,000 times more sensitive to truncation than semantic representations (Wee et al., 2025). Protecting models requires selective mixed-precision (Al Hakim et al., 2026; Wee et al., 2025), vector quantization (VQ) (Xu et al., 2025), and contrastive alignment optimizations (Wee et al., 2025) to recover up to 97.2% of safety (Wee et al., 2025).\n\nConsider the bank vault. You test its six-inch steel door against blowtorches, drills, and physical battering rams in a secure laboratory, signing off on a perfect safety certificate. Yet, when you install that same door on your branch, you replace its solid steel core with compressed aluminum foil to save on shipping costs. This sounds absurd, but it is the exact trade-off occurring across the enterprise AI ecosystem today. We audit our foundation models at pristine, full-precision 16-bit floating-point (FP16 or BF16) formats, only to deploy them on edge-devices under lossy 4-bit or 8-bit Post-Training Quantization (PTQ) to control compute costs (Frantar et al., 2023; Wee et al., 2025).\n\nThis computational downsizing exposes a gaping security vulnerability known as “alignment collapse” or “safety degradation” (Wee et al., 2025; Yi et al., 2024). When we squeeze model parameters to lower bit-widths, the delicate safety guardrails established via Reinforcement Learning from Human Feedback (RLHF) and Direct Preference Optimization (DPO) are the first features to evaporate (Wee et al., 2025; Yi et al., 2024). The model does not slowly lose coherence; rather, it experiences a silent, sudden reversion to its unaligned, raw pre-trained state (Wee et al., 2025; Yi et al., 2024). Crucially, this regression occurs without any warning from standard performance benchmarks (Wee et al., 2025; Yi et al., 2024). A model can score beautifully on general accuracy benchmarks and maintain immaculate linguistic perplexity, all while completely losing its ability to refuse harmful instructions (Wee et al., 2025; Yi et al., 2024).\n\nEnterprise risk managers are effectively flying blind, certifying models based on full-precision (FP16) baselines that share only a nominal relationship with the quantized artifacts running in production. This mismatch means that standard safety certifications are virtually meaningless once the optimization pipeline begins. To mitigate this risk, enterprise risk managers must stop certifying models based on full-precision (FP16) base-model evaluations and implement post-compression behavioral audits as a mandatory deployment gateway. This shift is the only way to prevent silent safety degradation from leaking into production systems.\n\n*This conceptual model demonstrates the security disconnect in enterprise AI pipelines, where robust safety checks applied to the base FP16 model fail to detect the silent vulnerabilities introduced during low-precision deployment.*\n\nThe root of this problem lies in the objective mismatch that defines standard quantization algorithms. Highly popular frameworks like GPTQ and Activation-aware Weight Quantization (AWQ) are optimized solely to minimize reconstruction errors on small calibration datasets (Frantar et al., 2023; Wee et al., 2025). For example, GPTQ works layer-by-layer, running complex Hessian matrix calculations to minimize Mean Squared Error (MSE) or Kullback-Leibler (KL) divergence between the high-precision and quantized weights (Frantar et al., 2023; Wee et al., 2025). This mathematical pipeline is incredibly elegant, but it is completely blind to preference-tuned behavioral boundaries (Wee et al., 2025).\n\nThe algorithm assumes that as long as the reconstruction error is small, the model’s core behavior remains unchanged (Wee et5, 2025). (Wee et al., 2025).\n\nThis assumption is a dangerous myth because perplexity and safety are fundamentally decoupled during compression. A model can retain its linguistic accuracy and reasoning benchmarks while its refusal mechanisms undergo catastrophic failure (Wee et al., 2025; Yi et al., 2024). This decoupling explains why engineers are often blindsided when a seemingly perfect model begins generating highly toxic outputs under adversarial prompts (Wee et al., 2025; Yi et al., 2024). To make matters worse, the common industry belief that Quantization-Aware Training (QAT) is an inherently safer alternative is largely incorrect (Chen et al., 2025; Wee et al., 2025). Studies evaluating QAT variants show that techniques like QLoRA or Straight-Through Estimators (STE) can actively accelerate the “catastrophic forgetting” of safety alignment (Chen et al., 2025; Wee et al., 2025). During QAT, simulated quantization noise forces weight updates that systematically overwrite the subtle, fragile parameter adjustments made during RLHF (Chen et al., 2025; Wee et al., 2025).\n\nThe takeaway for engineering teams is stark: preserving standard linguistic capability does not preserve safety. When optimizing models, engineering teams must decouple utility evaluations from safety evaluations during model compression pipelines. Relying on standard validation datasets to guarantee the ethical behavior of quantized models is a recipe for silent, catastrophic failure in production environments.\n\n*Visualizing ‘silent collapse’ where standard optimization metrics (such as perplexity) remain fully preserved on one scale pan while the model’s safety guardrails completely shatter on the other.*\n\nTo understand why safety alignment is so fragile, we must step into the high-dimensional activation spaces of Large Language Models. Human-aligned behaviors do not scale uniformly across the model’s entire representation geometry. Instead, safety features are concentrated within highly fragile, low-dimensional activation subspaces (Wee et al., 2025). Think of self-attention like a crowded cocktail party where semantic information is the loud, dominant chatter filling the room, while safety alignment is a quiet, specialized conversation occurring in a tiny, isolated corner. When we quantize a model, we are effectively turning down the overall volume, and that quiet conversation is the first to be drowned out by noise.\n\nThis vulnerability can be measured mathematically using the Energy-Concentration Ratio. This ratio is defined as:\n\nEnergy-Concentration Ratio = Energy per-dimension in safety subspace % Average representation energy\n\nIn models experiencing severe alignment collapse, this ratio sits between 10⁻³ and 10⁻² (Wee et al., 2025). This means the safety subspace is 100 to 1,000 times more vulnerable to precision truncation than the broader semantic features (Wee et al., 2025). When standard quantizers compress the model’s weights, this extreme sensitivity triggers three distinct, mechanistic failure modes (Wee et al., 2025).\n\n*Geometric visualization showing how safety features reside in fragile, low-dimensional subspaces that are crushed under quantization, while the surrounding semantic structures remain largely unaffected.*\n\nThe first is the “Outlier-Crushes-Safety” dynamic (Wee et al., 2025). Large language models naturally develop extreme activation outlier channels with massive dynamic ranges to maintain their logical reasoning capabilities (Wee et al., 2025). Because standard quantizers must adjust their scaling factors to accommodate these giant outliers, the low-magnitude safety features are squeezed into a tiny handful of quantization bins (Wee et al., 2025). The signal-to-noise ratio in these non-outlier channels becomes so poor that the safety features are completely erased (Wee et al., 2025). The second mode is “Outlier-as-Safety,” which occurs when safety mechanisms directly overlap with these outlier channels (Wee et al., 2025).\n\nHere, the safety features hit a hard precision ceiling where finer-grained quantization schemas cannot resolve the subtle boundaries of ethical refusal, causing the guardrails to fail completely (Wee et al., 2025).\n\nThe third mechanistic failure is “Multi-Layer Dilution” (Wee et al., 2025). As quantization noise accumulates cumulatively across these layers, the subtle safety signals are systematically diluted until they disappear entirely (Wee et al., 2025). This is why simple mixed-precision patches targeting only a few layers are usually ineffective at preventing systemic alignment collapse (Wee et al., 2025). AI architects must profile the activation geometry of models before quantization to determine if safety features are bottlenecked in outlier channels or diluted across layers before they trigger production failures.\n\n*Visualizing the mechanical asymmetry of KV cache compression where the Key (K) projection experiences disproportionately high structural error under long-context token pressure compared to the stable Value (V) projection.*\n\nThe degradation of safety is not limited to static weight matrices; it also severely impacts runtime memory optimizations like Key-Value (KV) cache quantization. When deploying models at scale, quantizing the KV cache is essential to fit long-context prompts within GPU memory, yet the safety implications of this step are almost universally ignored (Wee et al., 2025). Rigorous evaluations reveal a profound structural asymmetry within the attention mechanism: Key (K) projection quantization drives between 76% and 102% of all alignment damage (Wee et al., 2025). This happens because the Mean Squared Error (MSE) incurred during K-projection is 4 to 87 times higher than the error observed in the Value (V) projection (Wee et al., 2025). The geometric patterns that recognize harmful intent are heavily encoded in the keys, making them incredibly sensitive to truncation (Wee et al., 2025).\n\nThis theoretical vulnerability becomes a major liability in standard production environments. GPUs running FP8 dynamic serving typically rely on the standard fp8_e5m2 format, which allocates 5 bits to the exponent and only 2 bits to the mantissa (Wee et al., 2025). This limited mantissa resolution fails to resolve the critical, low-magnitude channels where safety is encoded (Wee et al., 2025). In production serving tests on Qwen architectures, this lack of resolution led to conditional flip rates — where a safe refusal reverts to harmful compliance — exceeding 30% (Wee et al., 2025). In contrast, utilizing the slightly more precise fp8_e4m3 format, which allocates 3 bits to the mantissa, provides a much-needed precision buffer that helps preserve safety boundaries (Wee et al., 2025).\n\nThis issue is further amplified when models process extended contexts. Processing inputs past 64K tokens acts as a compounding multiplier for quantization error, resulting in a total collapse of the alignment boundary (Mekala et al., 2025; Wee et al., 2025). For instance, when the LLaMA-3.1 70B model is quantized using 4-bit normal float (BNB-nf4), its retrieval accuracy and safety compliance drop by 32% to 59% on long-context benchmarks like ONERULER (Mekala et al., 2025). Under these conditions, the model suffers a complete breakdown: it simultaneously complies with harmful prompts buried deep in the text and over-refuses completely benign queries (Mekala et al., 2025; Wee et al., 2025).\n\n``` php\nQuantization Noise Multiplier[Extended Input (>64K Tokens)] ---> [Compounded Quantization Error] ---> [Refusal Failure / Compliant Toxicity]\n```\n\nTo recover from this, organizations must deploy Per-Channel Reduction (PCR) diagnostics (Wee et al., 2025). This diagnostic framework classifies model failure modes and can recover up to 97.2% of lost alignment by protecting key channels in higher precision (Wee et al., 2025). When configuring serving engines (like vLLM or TensorRT-LLM), protect the Key (K) projections with selective precision, avoid fp8_e5m2 for safety-critical agents, and run PCR diagnostics on custom calibration prompts.\n\n*Visualizing the asymmetric impact of quantization as a ‘Linguistic Safety Tax,’ where safety guardrails for non-Latin scripts and regional dialects collapse while English safety remains protected.*\n\nWhile quantization hurts model performance across the board, its most troubling impact is highly asymmetric. Model compression acts as an invisible, discriminatory “linguistic safety tax” that disproportionately impacts non-English speakers, regional dialects, and non-Latin scripts (Al Hakim et al., 2026; Zaghouani, 2026). This dynamic creates a severe “low-resource double bind” (Al Hakim et al., 2026). Underserved linguistic communities and severe compute constraints often go hand-in-hand, meaning that the populations most in need of efficient, quantized edge models are precisely the ones receiving the most dangerous, unaligned systems (Al Hakim et al., 2026).\n\nThis discrepancy is starkly visible when examining script-based degradation. On a massive 103-billion parameter model, Latin-script safety dropped by a negligible 0.7% under quantization, while non-Latin script safety fell by a much larger 1.9% (Al Hakim et al., 2026). When evaluating smaller 8-billion parameter models, this gap widens significantly, showing a 3.0% safety drop for Latin scripts compared to a 5.5% collapse for non-Latin scripts (Al Hakim et al., 2026). This happens because compression algorithms systematically prioritize high-representation English syntax to satisfy strict bit-width budgets (Al Hakim et al., 2026). Since English safety alignment is deeply entrenched through massive preference datasets, long-tail multilingual safety features are systematically discarded as expendable noise during the compression process (Al Hakim et al., 2026). This systemic erosion also degrades mathematical reasoning in non-English contexts, which drops by 13.1% under 4-bit group-wise quantization (Al Hakim et al., 2026).\n\nThe problem goes even deeper when we examine regional dialects. In diglossic languages like Arabic, standard safety alignment is trained almost exclusively in Modern Standard Arabic (MSA), while everyday communication occurs in regional dialects (Zaghouani, 2026). This mismatch creates the “Dialect Safety Gap,” where models lose the fragile semantic mapping linking colloquial dialects to MSA-trained safety filters (Zaghouani, 2026). Under quantization, a model fails to recognize harmful intent when presented in regional dialects, complying with requests it would otherwise refuse (Zaghouani, 2026).\n\nFurthermore, standard automatic benchmarks completely mask this decline. On Japanese benchmarks, automated evaluations estimated a minor quality drop of just 1.7%, but blinded human evaluators reported a massive 16.0% collapse in safety and output quality (Al Hakim et al., 2026). Organizations deploying multilingual LLMs cannot rely on automated perplexity or log-likelihood benchmarks; they must use local human evaluation panels to discover the true “Linguistic Safety Tax” of compressed models.\n\n*Visualizing the mechanics of Quantization-Conditioned Backdoors, where benign high-precision models are mathematically engineered to snap into malicious, triggered states due to rounding errors during compression.*\n\nThe systemic instability of quantized alignment has birthed a highly sophisticated new attack surface. Malicious actors are no longer restricted to standard runtime jailbreaks; they are now actively weaponizing precision boundaries to build dormant, quantization-conditioned exploits (Zheng et al., 2026). These exploits, known as Quantization-Conditioned Backdoors (QCBs), allow attackers to distribute seemingly benign, high-precision models that pass all standard security audits (Zheng et al., 2026). However, the attacker has mathematically engineered the model’s weight distributions so that the malicious behaviors lie precisely on the boundaries of quantization bins (Zheng et al., 2026). When an unsuspecting end-user quantizes the model for deployment, the rounding operations applied during compression snap the weights into a configuration that triggers the backdoor (Zheng et al., 2026).\n\n``` php\nFP16 Auditing (Passes perfectly) ---> user applies rounding ---> Rounding Error (Snaps weights to backdoor) ---> Triggered Exploit\n```\n\nA similar threat vector is the Q-Misalign attack, which represents an incredibly durable form of adversarial misalignment (Dong et al., 2025). In this attack model, a base model is first trained on explicitly toxic datasets to generate harmful outputs (Dong et al., 2025). The attacker then applies a process of constrained unlearning or Contrastive Task Vectors to make the model appear safe and pass standard audits (Dong et al., 2025). Crucially, this unlearning is engineered to be highly sensitive to quantization noise (Dong et al., 2025). When the user quantizes the model, the rounding errors disrupt the fragile unlearning layer, reactivating the latent harmful capabilities (Dong et al., 2025). This attack is highly resilient, persisting even if the user attempts subsequent fine-tuning or in-context prompt engineering (Dong et al., 2025).\n\nStandard static backdoor defenses are completely ineffective against these exploits because they wrongly assume that model behaviors remain uniform across precision limits (Zheng et al., 2026). To secure the model supply chain, model supply chain security must verify the origin of weights and implement defenses like QuantGuard to disrupt the mathematical alignment of backdoor triggers prior to deployment. QuantGuard disrupts the mathematical alignment of backdoor triggers, preventing the rounding trap from activating during deployment (Zheng et al., 2026).\n\n*Visualizing why traditional scalar quantization collapses below 3 bits (left) and how high-dimensional vector quantization (right) densifies parameters to safely preserve delicate model alignment.*\n\nThe severity of alignment collapse is directly tied to the target bit-width of the compressed model. Traditional scalar quantization formats, such as GGUF, AWQ, and GPTQ, map continuous weights to a static, evenly spaced grid, but this approach hits a massive error wall below 3 bits (Wee et al., 2025; Xu et al., 2025). Squeezing a continuous distribution of billions of parameters into just 4 states (for 2-bit quantization) or 8 states (for 3-bit quantization) completely erases the non-linear dependencies required to maintain safety guardrails (Wee et al., 2025; Xu et al., 2025). At these extreme compression limits, scalar models inevitably suffer catastrophic representational collapse, either generating gibberish or completely losing their safety refusal behaviors (Wee et al., 2025; Xu et al., 2025).\n\nTo cross this 3-bit barrier safely, advanced architectures are moving away from scalar approaches and adopting Vector Quantization (VQ) (Xu et al., 2025). VQ frameworks, such as AQLM, QuIP#, VPTQ, and RSAVQ, group contiguous weights into multi-dimensional vectors and map them to a highly optimized shared codebook (Xu et al., 2025). This geometric approach allows VQ to exploit spatial probability density functions and complex multidimensional structures, such as the 8-dimensional E’ Gosset lattice (the densest known sphere packing in 8 dimensions) (Xu et al., 2025). By packing spheres densely in higher dimensions, VQ preserves the critical, high-sensitivity parameter regions where safety features reside (Xu et al., 2025).\n\nSOTA frameworks like RSAVQ use Error Direction Sensitivity Guidance (EDSG) via the Fisher Information Matrix (FIM) to project quantization noise onto low-sensitivity parameter directions (Xu et al., 2025). Evaluations on the OpenMiniSafety dataset confirm that vector quantization preserves robust safety and refusal behaviors that scalar models lose instantly (Xu et al., 2025). For extreme compression needs (sub-3-bit execution on edge devices), abandon scalar GGUF/GPTQ formats and adopt vector quantization frameworks like QuIP# or AQLM to protect safety constraints while achieving maximum efficiency.\n\nSecuring quantized models requires a major shift in how we approach optimization. We must abandon simple reconstruction error algorithms and adopt alignment-preserving optimization pipelines. The most powerful pre-emptive defense is Alignment-Aware Quantization (AAQ), which replaces standard objective functions with an Alignment-Preserving Contrastive (APC) loss (Wee et al., 2025). AAQ operates using a three-model framework: the target quantized model (M_Q), an unquantized safe model (M_FT), and an unaligned reference model (M_PT) (Wee et al., 2025). The contrastive loss is defined as:\n\n*Visualizing the three-model contrastive loss framework (AAQ), where the target model’s behavior is optimized by pulling its alignment toward a safe reference while actively pushing it away from unaligned states.*\n\nℒ_APC = ℒ_KL-top — ℒ_cont-top\n\nWhere ℒ_KL-top pulls the quantized model’s output distribution to match the safe, instruction-tuned reference (retaining utility), and ℒ_cont-top actively pushes it away from the toxic behaviors of the unaligned pre-trained model (Wee et al., 2025).\n\nTo maintain stability and prevent perplexity from exploding, AAQ uses a selective top-k filtering strategy that optimizes only the sparse subset of vocabulary indices where the safe and unsafe models diverge the most (S_diff) (Wee et al., 2025). This approach maximizes the Gradient Signal-to-Noise Ratio (GSNR), focusing updates strictly on critical behavioral transitions (Wee et al., 2025). This optimization process is incredibly efficient: securing a LLaMA-2–7B model under W4A4 quantization takes only 26 minutes on a single A100 GPU and introduces zero runtime latency (Wee et al., 2025). Another powerful method is Critical Weight Protection (CWP), which uses sensitivity analysis to approximate the Fisher Information Matrix (Al Hakim et al., 2026). By calculating FAIRSCORE(θ) and SAFESCORE(θ), CWP isolates the top-k% of parameters critical to safety and freezes them in high-precision (FP16), while quantizing the rest of the network to INT4 (Al Hakim et al., 2026).\n\nFor pre-quantized models, the Q-resafe framework offers a post-hoc patching mechanism (Chen et al., 2025). Q-resafe constructs a distillation dataset of preference triplets, uses SNIP scores to mask and identify safety-critical weights, and applies Direct Preference Optimization (DPO) to restore the safety baseline (Chen et al., 2025). Meanwhile, defensive tools like QuantGuard use differentiable rounding control to sanitize weights, disrupting the rounding trap and neutralizing quantization-conditioned backdoors prior to deployment (Zheng et al., 2026).\n\nModel / Architecture Full Precision (FP16) ASR Standard PTQ (GPTQ/AWQ) ASR Q-resafe Patching ASR AAQ / Contrastive Loss ASR Llama-2–7B-Chat ~29.8% 42.4% (INT4) / 39.1% (INT8) (Chen et al., 2025; Wee et al., 2025) ~31.3% (Recovers to near baseline) (Chen et al., 2025) Fully Recovers to FP16 baseline (Wee et al., 2025) Gemma-7B-Instruct ~9.4% 17.9% (INT4) / 15.1% (INT8) (Chen et al., 2025) ~10.3% (Under 1% degradation) (Chen et al., 2025) Fully Recovers to FP16 baseline (Wee et al., 2025) Mistral-7B v0.3 Near 0% (High Refusal) 15.2% (Conditional Flip) (Wee et al., 2025) High Refusal Restored (Chen et al., 2025) High Refusal Restored (Wee et al., 2025) Qwen-2.5–72B High Refusal 98.4% (Catastrophic 2-bit Collapse) N/A (Requires VQ at 2-bit) Superior to baseline PTQ (Wee et al., 2025)\n\nTransitioning optimization workflows from naive reconstruction algorithms to contrastive, alignment-aware pipelines (like AAQ) or post-hoc patching (like Q-resafe) is crucial to arrest safety leaks. This ensures that the computational savings of quantization do not come at the cost of corporate liability and user trust.\n\nTreating model compression as a purely mathematical optimization step is the single biggest security mistake in modern enterprise AI deployment. As we scale models to edge-device execution, safety and compression can no longer be decoupled. We must establish rigorous, model-specific safe-quantization floors and replace simple automated perplexity benchmarks with contrastive alignment audits. True safety is geometric, and it requires us to treat behavioral preservation as a first-class citizen of model optimization.\n\nTo prevent silent safety leaks, organizations must adopt a rigorous validation checklist:\n\n*Do not deploy what you have not audited post-quantization. Your FP16 safety certificates are completely meaningless at the 4-bit edge.*\n\nFrantar, E., Ashkboos, S., Hoefler, T., & Alistarh, D. (2023). GPTQ: Accurate post-training quantization for generative pre-trained transformers. *International Conference on Learning Representations (ICLR 2023)*. [https://doi.org/10.48550/arXiv.2210.17323](https://doi.org/10.48550/arXiv.2210.17323)\n\nWee, S., Kim, S., Kim, H., Hwang, K., & Kwak, N. (2025). Alignment-aware quantization for LLM safety. *arXiv preprint arXiv:2511.07842*. [https://doi.org/10.48550/arXiv.2511.07842](https://doi.org/10.48550/arXiv.2511.07842)\n\nYi, J., Ye, R., Chen, Q., Zhu, B. B., Chen, S., Lian, D., Sun, G., Xie, X., & Wu, F. (2024). On the vulnerability of safety alignment in open-access LLMs. *Findings of the Association for Computational Linguistics: ACL 2024*, 9236–9260. [https://doi.org/10.18653/v1/2024.findings-acl.549](https://doi.org/10.18653/v1/2024.findings-acl.549)\n\nMekala, A., Atmakuru, A., Song, Y., Karpinska, M., & Iyyer, M. (2025). Does quantization affect models’ performance on long-context tasks? *Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing*, 9422–9470. [https://doi.org/10.18653/v1/2025.emnlp-main.584](https://doi.org/10.18653/v1/2025.emnlp-main.584)\n\nXu, Z., Hu, X., Wu, Q., & Yang, D. (2025). RSAVQ: Riemannian sensitivity-aware vector quantization for large language models. *arXiv preprint arXiv:2510.01240*. [https://doi.org/10.48550/arXiv.2510.01240](https://doi.org/10.48550/arXiv.2510.01240)\n\nAl Hakim, M. A., Wicaksono, A. F., & Koto, F. (2026). Preserving fairness and safety in quantized LLMs through critical weight protection. *Findings of the Association for Computational Linguistics: ACL 2026*, 19831–19855. [https://doi.org/10.18653/v1/2026.findings-acl.123](https://doi.org/10.18653/v1/2026.findings-acl.123)\n\nZaghouani, W. (2026). Toward dialect-aware safety evaluation for Arabic large language models. *Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)*, 503–514. [https://doi.org/10.18653/v1/2026.trustnlp-1.37](https://doi.org/10.18653/v1/2026.trustnlp-1.37)\n\nChen, K., Zhang, J., Hu, J., Wang, Y., Song, M., Lou, J., & Feng, Z. (2025). Assessing safety risks and quantization-aware safety patching for quantized large language models. *Proceedings of the 42nd International Conference on Machine Learning*, PMLR 267, 9728–9746. [https://doi.org/10.48550/arXiv.2506.20251](https://doi.org/10.48550/arXiv.2506.20251)\n\nDong, P., Li, H., & Guo, S. (2025). Durable quantization conditioned misalignment attack on large language models. *13th International Conference on Learning Representations (ICLR 2025)*. [https://openreview.net/forum?id=GZm8-6l31U](https://openreview.net/forum?id=GZm8-6l31U)\n\nZheng, A., Du, A., Deng, Z., & Chen, Y. (2026). Breaking the rounding trap: Securing LLMs against quantization-conditioned backdoors. *arXiv preprint arXiv:2606.29239*. [https://doi.org/10.48550/arXiv.2606.29239](https://doi.org/10.48550/arXiv.2606.29239)\n\n*Disclaimer: The views and opinions expressed in this article are personal and do not necessarily reflect the official policy or position of any associated agencies, organizations, or the India AI Mission. AI assistance was utilized in the research, drafting, and ideation of this article. Licensed under CC BY-ND 4.0.*\n\n[Why Standard LLM Audits Miss 90% of Safety Failures](https://pub.towardsai.net/why-standard-llm-audits-miss-90-of-safety-failures-69d05c41e26d) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.", "url": "https://wpnews.pro/news/why-standard-llm-audits-miss-90-of-safety-failures", "canonical_source": "https://pub.towardsai.net/why-standard-llm-audits-miss-90-of-safety-failures-69d05c41e26d?source=rss----98111c9905da---4", "published_at": "2026-08-04 15:36:01+00:00", "updated_at": "2026-08-04 16:22:29.170582+00:00", "lang": "en", "topics": ["ai-safety", "ai-research", "ai-infrastructure"], "entities": ["Wee et al.", "Yi et al.", "Al Hakim et al.", "Xu et al.", "Frantar et al."], "alternates": {"html": "https://wpnews.pro/news/why-standard-llm-audits-miss-90-of-safety-failures", "markdown": "https://wpnews.pro/news/why-standard-llm-audits-miss-90-of-safety-failures.md", "text": "https://wpnews.pro/news/why-standard-llm-audits-miss-90-of-safety-failures.txt", "jsonld": "https://wpnews.pro/news/why-standard-llm-audits-miss-90-of-safety-failures.jsonld"}}