Module 18 Lesson 4: Quantization and pruning security risks

To make AI models run on phones (like iPhones), we use Quantization (reducing the precision of numbers) and Pruning (deleting "unimportant" neurons). These optimizations save space, but they break security.

1. Safety Filter Erasure

Model safety is often hidden in the "Fine details" of the weights.

• The Risk: When you Quantize a model from 16-bit to 4-bit, you are throwing away 75% of the information.
• The Result: The "Safety neurons" that were trained to block NSFW content or jailbreaks might be the first ones to be "simplified" away.
• Case Study: Researchers found that a "Safe" 16-bit model became a "Vulnerable" 4-bit model even though the prompt was the same.

---

2. Decision Boundary Shifting

Quantization changes the "Shape" of the model's math.

• The Attack: An adversarial example that was "Blocked" by the high-precision model might "Leak through" the low-precision model because the "Mathematical wall" has been lowered.
• If we "Prune" the wrong part of the network, we might accidentally make a "Backdoor" trigger much easier to hit.

---

3. Vulnerability to "Side-Channel" Attacks

Smaller, faster models have predictable computation patterns.

• The Attack: By measuring the Power Consumption or EMI (Electromagnetic Interference) of a phone running a 4-bit model, an attacker can more easily "reverse engineer" what the model is thinking.
• This is a "Hardware-level" privacy breach made possible by model optimization.

---

4. Best Practices for Optimized Models

1. Safety-Aware Quantization: When compressing a model, you must re-run your complete Red Team suite. Don't assume the "Tiny" version is as safe as the "Original" version.
2. Fine-tuning after Compression: After you prune or quantize a model, you should do a "Safety fine-tune" to re-teach the smaller model its boundaries.
3. Use 8-bit as a Baseline: 4-bit (and 2-bit or 1-bit) models are extremely prone to "Safety Collapse." 8-bit is generally considered the "Safe" limit for most enterprise tasks.

---

Exercise: The Optimization Auditor

1. Why does "Quantization" (rounding numbers) cause a model to lose its "Moral Filters"?
2. You are optimizing an AI to run on a Smart Watch. Which is more important: Max Efficiency or Min Vulnerability?
3. How can "Pruning" (deleting neurons) be compared to "Surgical Brain damage"?
4. Research: What is "Quantization Error" and how can it be used as a source of adversarial noise?

---

Summary

Optimization is a Security Trade-off. Every time you make an AI smaller and faster, you are making its "Defense Layers" thinner. You must verify and re-verify your safety guardrails every time you change the bit-width of your model.

Next Lesson: Poisoning the well: Poisoning foundation models at scale.