Project summary

I've been working on multilingual AI safety and recently started wondering about something that seems easy to overlook: what happens to a model's safety behavior when we compress it?

4-bit quantization is becoming a very practical way of running open-weight models with much less memory and lower inference costs. That's useful, but we usually evaluate the safety of a model at one particular precision and then move on. I want to see whether that assumption is actually safe, especially for languages that have much less representation in the training data.

The main question I'm asking is whether 4-bit quantization can reduce harmful-refusal behavior more in lower-resource languages than in higher-resource languages.

I'll compare the BF16 and 4-bit versions of Qwen3-4B and Llama-3.1-8B-Instruct across 10 languages. For the safety evaluation I'll use MultiJail, and I'll use Belebele as a capability control. The control is important because a model becoming worse at a language in general isn't necessarily a safety failure. I want to know whether there is an additional drop specifically in its ability to refuse harmful requests.

I'm also interested in what might be happening inside the model if I do find an effect. It could be that quantization changes the model's representation of the harmful content itself. It could also be that the model still recognizes what the prompt is about, but the final refusal behavior is less likely to happen. I'll use activation analysis and causal interventions to investigate that.

I've already done most of the setup. Both models are loading on an H100, BF16 and NF4 inference are working, and the transformer hooks are running under both conditions. The multilingual datasets are pinned and the evaluation pipeline is reproducible. I've also checked the safety evaluator against WildGuard.

So the project is past the initial setup stage. The main thing I need now is enough compute to actually run the multilingual experiments and then investigate the results in more detail.

What are this project's goals? How will you achieve them?

The first thing I want to establish is whether quantization changes refusal behavior differently across languages.

But I don't want to stop at finding a difference in refusal rates. The harder question is whether that difference is actually specific to safety.

For example, imagine the quantized model gets worse at Hindi across a bunch of different tasks. If it also refuses harmful prompts less often in Hindi, that doesn't necessarily mean quantization created a new safety vulnerability. It could just mean the model has become worse at Hindi overall. That's why I'm measuring general multilingual capability alongside the safety behavior.

I'll also look at things like tokenization and other possible confounders. I don't want to end up with an interesting-looking result that turns out to have a much simpler explanation.

If the behavioral results show a real effect, I'll move on to the activation-level part. I'm interested in whether the internal processing of the harmful prompt changes after quantization, and whether the difference is closer to the model recognizing the harmful content or to the later decision to refuse it.

The engineering side is already mostly done. I've tested both checkpoints on an NVIDIA H100, verified BF16 and NF4 inference, got the activation hooks working, and prepared the multilingual datasets and evaluation code. What I'm missing now is the compute to run everything properly.

How will this funding be used?

Most of the funding will go toward H100 GPU time.

I need to run the BF16 and NF4 conditions across the 10 languages, along with the capability-control experiments. After that, I'll use additional compute for the activation and causal-intervention experiments.

A smaller amount will go toward storage and related research infrastructure so I can keep the raw outputs, activation summaries, and experiment artifacts rather than only keeping the final numbers.

The $500 minimum is mainly what I need to get the core experiment finished. The $1200 goal would let me run more repeats and robustness checks and spend more time on the mechanistic part instead of stopping after the first set of results.

Who is on your team? What's your track record on similar projects?

It's just me.

I'm an undergraduate researcher in Mumbai working on trustworthy AI, AI safety, and mechanistic interpretability. My college doesn't currently have an AI safety lab, club, or reading group that I can work with, so most of what I've learned in this area has come from reading papers, going through open-source implementations, and building things myself.

Before starting this project, I worked on healthcare LLM evaluation and a mechanistic audit of multimodal medical models. That work involved transformer models, PyTorch, activation-level analysis, and evaluation pipelines.

I also have a sole-authored paper accepted at the MI4MedFM workshop at MICCAI 2026. The paper looks at whether multimodal medical models actually use clinical text when making predictions, and I used activation patching, counterfactual experiments, and sparse autoencoders to investigate that question.

Paper: https://openreview.net/forum?id=0WdP9Rg0P1

Code: https://github.com/gauravhadavale07/reading-between-the-lesions

I've also been applying the same general approach to language models, including my preprint on causal auditing of latent affect in LLMs.

For this project, I've built the model setup, quantization pipeline, dataset pipeline, safety evaluation, and activation hooks myself.

Portfolio: https://gauravhadavale07.github.io/v2/

What are the most likely causes and outcomes if this project fails?

There is a very real possibility that the main hypothesis is simply wrong.

Quantization might make low-resource languages worse, but only because the model's overall capability in those languages has gone down. It's also possible that the apparent safety difference disappears once I account for tokenization or another confounding factor.

If that happens, I still think the experiment is worth doing. I'd rather find out that the effect isn't there than start with the assumption that it must be.

The mechanistic part is also uncertain. Even if I find a behavioral difference, I may not be able to identify one clean internal mechanism behind it. Transformer representations are often distributed, so the activation experiments might give me a more complicated answer than “this one component caused it.”

There are also the usual compute and engineering risks with larger experiment runs. I've set up resumable checkpoints so that an interrupted job doesn't mean losing everything already completed.

Whatever the outcome, I'll report the negative or inconclusive results as well as any positive finding.

How much money have you raised in the last 12 months, and from where?

$0.

I haven't raised external funding for this project. The work so far has been self-funded and supported by access to research compute.

This is my first dedicated funding request for the project.