Project Summary

I’ve been doing multilingual AI safety work recently, and one question that seems surprisingly easy to overlook is: what happens to model safety when we compress a model?

4-bit quantization is becoming a practical way to run open-weight models with substantially lower memory requirements and cheaper inference. However, we typically evaluate a model at a particular precision and then assume that its safety properties carry over to the quantized version.

I want to test whether that assumption actually holds, particularly for languages that receive relatively little representation in model training data.

The central question is:

Does 4-bit quantization cause a larger reduction in harmful-refusal behaviour in lower-resource languages than in higher-resource languages?

I will compare BF16 and 4-bit versions of Qwen3-4B and Llama-3.1-8B-Instruct across 10 languages. For safety evaluation, I will use the MultiJail benchmark, with Belebele as a capability control. The capability control is important because a model simply becoming worse at a language does not necessarily constitute a safety failure. I want to distinguish a general degradation in language ability from an additional degradation specifically in the model's ability to refuse harmful requests.

If I find a meaningful effect, I will investigate what is happening internally through activation analysis and causal interventions. One possibility is that quantization changes how harmful content is represented. Another is that the model continues to recognize the topic of the harmful request, but the downstream refusal behaviour is less likely to manifest.

The project is now beyond the setup stage. Both models load successfully on an NVIDIA H100, BF16 and NF4 inference are working, and transformer hooks have been verified under both configurations. The multilingual datasets have been pinned, the evaluation pipeline is reproducible, and I have cross-checked the safety evaluator against WildGuard.

The main remaining requirement is sufficient compute to run the full multilingual experiments and conduct the subsequent analysis.

What are this project's goals? How will you achieve them?

The primary goal is to determine whether the effect of quantization on model refusal behaviour varies systematically across languages, particularly between lower-resource and higher-resource languages.

A second goal is to determine whether any observed difference is actually safety-specific.

For example, suppose the quantized model performs worse on Hindi across a range of tasks. A reduction in harmful-refusal behaviour alone would not necessarily demonstrate a new safety vulnerability: the model may simply have become less capable in Hindi overall.

This is why I will use Belebele as a capability control. I will compare changes in general language capability against changes in harmful-refusal behaviour and test whether quantization produces an additional safety-specific degradation.

I will also investigate potential confounders such as tokenization characteristics, since an apparent language-specific effect could otherwise have a much simpler explanation.

If the behavioural results support the hypothesis, I will proceed to activation-level investigations. The aim will be to determine whether quantization changes internal processing of harmful prompts and, if so, whether the changes are more closely associated with:

1. recognizing the harmful nature of the request; or

2. the downstream process that produces the refusal.

This should allow me to move beyond simply measuring refusal rates and investigate potential mechanisms underlying any observed safety degradation.

The engineering side of the project is largely complete. I have personally:

• configured both model checkpoints;

• verified BF16 and NF4 inference on an NVIDIA H100;

• implemented activation hooks under both conditions;

• prepared the multilingual datasets;

• built the evaluation pipeline; and

• validated the safety evaluation against WildGuard.

The critical missing component is therefore computational capacity to run the experiments at sufficient scale and perform the mechanistic follow-up.

How will this funding be used?

The majority of the funding will be used for NVIDIA H100 GPU compute time.

The core experiment requires running both BF16 and NF4 conditions across 10 languages for both the MultiJail safety evaluation and the Belebele capability control. Additional compute will be required for activation analysis and causal intervention experiments if the behavioural results show a meaningful effect.

A smaller portion of the funding will be allocated to storage and associated research infrastructure. I want to retain raw model outputs, activation summaries, and experiment artifacts rather than keeping only final aggregate metrics, which will make the results easier to audit and reproduce.

The $500 minimum would allow me to run the core experiment.

A $1,200 budget would allow me to run additional repeats and robustness checks, while also allocating meaningful compute to the mechanistic investigation rather than stopping after the initial behavioural results.

Who is on your team? What's your track record on similar projects?

This is a solo research project.

I am an undergraduate researcher based in Mumbai, India, with a focus on Trustworthy AI, AI Safety, and Mechanistic Interpretability. My college does not currently offer dedicated AI safety courses, labs, clubs, or reading groups, so I have largely taught myself through papers, open-source codebases, and independent research projects.

Prior to this project, I worked on the evaluation of AI models for healthcare applications and conducted a mechanistic audit of multimodal medical models. This work involved transformer architectures, PyTorch, activation-level analysis, causal experiments, and building reproducible evaluation pipelines.

I have also been applying similar mechanistic techniques to general-purpose language models, including a recent preprint exploring causal audits of latent affect.

For this project specifically, I have personally developed the model loading and quantization setup, multilingual dataset pipeline, safety evaluation infrastructure, and activation-hook framework.

Portfolio

What are the most likely causes and outcomes if this project fails?

The most straightforward failure scenario is that my central hypothesis is simply false.

Quantization may cause lower-resource languages to perform worse, but this degradation could be entirely explained by a broader loss of language capability rather than a specific interaction between quantization and safety behaviour. Alternatively, an apparent safety effect could disappear after accounting for confounders such as tokenization.

Even in that case, I consider the experiment valuable. I would rather establish that an anticipated vulnerability does not exist than assume that it does based on an interesting but poorly controlled result.

The mechanistic investigation also carries uncertainty. Even if I observe a clear behavioural difference, it may be difficult to identify a single localized cause within the model. Transformer representations are distributed, and activation-level experiments may instead reveal a more complex mechanism.

There are also ordinary computational and engineering risks associated with running large experiments. To mitigate these, I have implemented checkpoint-based jobs so that interrupted experiments can resume without requiring the entire run to be repeated.

Regardless of the outcome, I intend to report negative and inconclusive results alongside positive findings.

How much money have you raised in the last 12 months, and from where?

$0.

I have not previously raised external funding for this project. All work completed so far has been my own, supported by access to existing research compute resources.

This is my first dedicated fundraising request for the project.