Research
What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 15 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
The verifiability gap in quantized LLM supply chains means signed full-precision weights do not guarantee the integrity of the GGUF artifact users actually run, opening a window for undetectable model tampering in widely distributed AI models.
The paper 'What You Sign Is Not What You Run' measures the Independent Verifiability Rate (IVR) of the GGUF quantized-LLM ecosystem, finding that none of the 200 most-downloaded Hugging Face GGUF repositories record their build environment, making 0/198 artifacts bit-for-bit reproducible by a third party. The authors show that model signing authenticates full-precision weights while users run quantized artifacts whose producing transformation is undetermined, and that benign floating-point non-determinism can be separated from nibble-flip tampering though targeted embedding edits evade the statistic. They release audit data and a re-runnable harness.