What You Sign Is Not What You Run: GGUF quantized model provenance audit

Evidence record

Liu and Tsai quantify missing environment provenance among the 198 most-downloaded in-scope GGUF repositories and demonstrate partial bit-exact reconstruction.

Read the original source ↗

Claim-level citations (3)

• supportsPopular GGUF model files lack the recorded provenance needed for bit-exact verification: Adding previously undisclosed build coordinates reproduced 7 of 8 selected quantized files on x86 and 5 of 8 on arm64.

  Abstract; Section IV, constructive reproduction

• supportsPopular GGUF model files lack the recorded provenance needed for bit-exact verification: The authors found 0 of 198 sampled in-scope popular GGUF repositories met their disclosed-input bit-exact rebuild protocol because build-environment provenance was missing.

  Abstract; Section IV, recorded-inputs IVR

• supportsPopular GGUF model files lack the recorded provenance needed for bit-exact verification: The GGUF audit found 148 of 198 representative repositories source-reconstructible under its base-model rule; all 198 lacked a recorded build-environment coordinate, so none met its stricter recorded-inputs verifier.

  Section III, Table II: 148/198 source reconstructible; Section IV, recorded-inputs IVR = 0/198