In short: their finding is that quantizing a model undoes various “unlearning” methods. An unlearning method is a specific update to model weights that make it forget specific facts. These are often meant to satisfy copyright claims, although I don’t know if these are ever used in practice.
I feel that this needs a good threat model analysis. Like, you possess an fp32 model, which someone has fine-tuned to forget some facts, which you can then quantize to recover those facts. When would this lead to a dangerous situation?
I feel that this needs a good threat model analysis. Like, you possess an fp32 model, which someone has fine-tuned to forget some facts, which you can then quantize to recover those facts. When would this lead to a dangerous situation?