The identity of a signed full-precision base model does not authenticate a third party's quantized weights. GGUF quantization depends not just on source weights, calibration and recipe, but also toolchain, architecture and floating-point behavior. A model card can name the original model correctly and still leave the executed quantized artifact impossible…
Inspect the ClaimsCase · DiggingBeagle record
Popular GGUF model files lack the recorded provenance needed for bit-exact verification
A study found that none of 198 popular in-scope GGUF repositories documented enough build-environment coordinates for recorded-inputs verification, yet 7 of 8 selected target files could be rebuilt exactly after supplying missing information.
Scope
Research audit of a popularity-selected GGUF ecosystem snapshot, not a census of all quantized formats or proof of malicious modification.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
A paper reports a measured verification-protocol gap, with a constructive reproduction subset. There is no demonstrated malicious GGUF deployment, attack campaign, or quantization backdoor. Toolchain provenance and independent rebuilding are practicable controls, not verified prevalence of malicious files.
Assessed Oct 17, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-GGUF-REBUILD-SEVEN · CLM-GGUF-RECORDED-ZERO · What You Sign Is Not What You Run: GGUF quantized model provenance audit
At a glance
The artifact used for inference must be bound to its exact derivation path, not merely to a separately signed original checkpoint.
Read the implicationsPublisher-side intentional weight poisoning and malicious calibration artifacts remain outside the demonstrated method. Independent multi-platform repetition and toolchain version pinning need further study. The percentage that would reproduce bit-for-bit after an unconstrained search for historical build environments was not measured across all 198 files.
Limits and uncertaintyFull account
The identity of a signed full-precision base model does not authenticate a third party's quantized weights. GGUF quantization depends not just on source weights, calibration and recipe, but also toolchain, architecture and floating-point behavior. A model card can name the original model correctly and still leave the executed quantized artifact impossible to check under a reproducible recorded-inputs procedure.
Liu and Tsai sampled 200 highly downloaded Hugging Face GGUF repositories, retaining 198 in scope. None recorded the required build-environment provenance for independent bit-exact reconstruction, yielding 0/198 under that specific protocol. This is not a finding that every file is inherently unreproducible: four selected repositories disclosed usable inputs, and specifying floating-point contraction plus per-tensor recipe information allowed seven of eight target quantizations to match bit-for-bit on x86 and five of eight on arm64.
The paper also explores tampering detection limits. Harmless quantizer differences can look like manipulated weights, while certain targeted embedding modifications can evade simple statistical checks. Full artifact signing proves what was signed, not how it was derived. Trusted source weights, hash-bound calibration data, exact compiler flags and deterministic rebuilds are different obligations. No live malicious model-publisher campaign is established.
A second denominator matters for procurement: under the authors' source-reconstruction rule, 148 of 198 sampled repositories had retrievable inputs that could in principle support rebuilding; all 198 lacked a recorded build-environment coordinate. The 0/198 result is therefore about documented verification under a specified protocol, not an assertion that none of the files could ever be re-derived. In the selected reconstruction exercises, searching for the right environment sometimes succeeded without a published record, which also does not validate an arbitrary downloaded file.
Timeline
- Oct 14, 2026disclosure
Public disclosure
Claims & evidence
CLM-GGUF-REBUILD-SEVENAdding previously undisclosed build coordinates reproduced 7 of 8 selected quantized files on x86 and 5 of 8 on arm64.supported
Basis: reported finding
- supportsWhat You Sign Is Not What You Run: GGUF quantized model provenance auditprimary disclosure
Abstract; Section IV, constructive reproduction
CLM-GGUF-RECORDED-ZEROThe authors found 0 of 198 sampled in-scope popular GGUF repositories met their disclosed-input bit-exact rebuild protocol because build-environment provenance was missing.supported
Basis: reported finding
- supportsWhat You Sign Is Not What You Run: GGUF quantized model provenance auditprimary disclosure
Abstract; Section IV, recorded-inputs IVR
CLM-GGUF-148-SOURCE-RECONSTRUCTIBLEThe GGUF audit found 148 of 198 representative repositories source-reconstructible under its base-model rule; all 198 lacked a recorded build-environment coordinate, so none met its stricter recorded-inputs verifier.supported
Basis: reported finding
- supportsWhat You Sign Is Not What You Run: GGUF quantized model provenance auditprimary disclosure
Section III, Table II: 148/198 source reconstructible; Section IV, recorded-inputs IVR = 0/198
Implications
The artifact used for inference must be bound to its exact derivation path, not merely to a separately signed original checkpoint.
Unknowns and contradictions
- Publisher-side intentional weight poisoning and malicious calibration artifacts remain outside the demonstrated method.
- Independent multi-platform repetition and toolchain version pinning need further study.
- The percentage that would reproduce bit-for-bit after an unconstrained search for historical build environments was not measured across all 198 files.
Sources and citation
Material revision history
- Oct 17, 2026 · Published version · first publication · revision 163