Detecting 4-Bit Adversaries at the Token Level

Egashira et al. (2024) show that an attacker who controls the served weights of a language model can construct checkpoints that match a clean reference at full precision yet pivot to malicious behavior after quantization. We evaluate whether Token-DiFR (Karvonen & Rinberg, 2025), a per-token verification protocol designed for natural quantization noise, also detects these attacks given black-box query access to the served model and a trusted full-precision reference. Token-DiFR wrongly flags as adversarial even honest 4-bit deployments on the constrained-training pipeline of Egashira et al. (2024), across three base models (Qwen2.5-0.5B-Instruct, Phi-2, StarCoderBase-1B), two 4-bit bitsandbytes schemes (NF4, FP4), and three attack scenarios (over-refusal, content injection, vulnerable-code generation). We then pro- pose precision-matched calibration, which pairs each served-precision evaluation with a served-precision baseline and isolates parameter drift from precision mismatch. With it, our test produces no false positives on clean served models while flagging every tested adversarial checkpoint.