arXiv 论文提出 KV cache 量化下的对齐崩溃诊断与 PCR 缓解方法
Alignment Collapse Under KV Cache Quantization: Diagnosis and Mitigation
AI 导读
arXiv 论文（arXiv:2606.09864）研究 KV cache 量化对大语言模型安全对齐的影响，发现在 11 个指令模型（3.8B-72B）和 5 个基准（1,894 条提示）上，低比特量化会静默破坏安全对齐，如 Mistral-7B 在困惑度仅 1.03x 时拒绝率损失 15.2%，且不存在通用安全比特宽度。
推荐理由
论文指出 KV cache 低比特量化会静默破坏安全对齐且困惑度指标看不见，并给出可定位失效机理的训练免费修复协议。
正文 · 原文
Abstract:Key-value (KV) cache quantization is widely used to reduce LLM inference memory, yet existing evaluations focus only on perplexity and accuracy without assessing the safety impact. In this study, we explore alignment preservation under KV cache quantization. Across eleven instruction-tuned models (3.8B-72B) and five benchmarks (1,894 prompts), we find that low-bit quantization can silently destroy safety alignment: Mistral-7B loses 15.2% of its refusals at only 1.03x perplexity, and no universal safe bit-width exists, with sharp model-specific phase transitions invisible to standard metrics. We identify that the root cause is geometric: safety features occupy a low-dimensional activation subspace $10^2$-$10^3\times$ more vulnerable to quantization noise than the full representation space perplexity averages over. We propose Per-Channel Reduction (PCR), a diagnostic that classifies each model into one of three mechanistic failure modes: outlier-crushes-safety, where safety lives in non-outlier channels collaterally damaged by outlier-driven scale factors; outlier-as-safety, where safety overlaps outlier channels and finer granularity cannot rescue it; and multi-layer dilution, where safety is distributed across many layers and per-layer fixes fail. PCR predicts the correct mitigation direction on all nine primary models and one held-out model from an independent family using 20 calibration prompts. PCR generalizes across unseen prompts, models, and quantizer families, including production quantizers (KIVI: up to 97.2% recovery) and rotation-based quantization (QuaRot-style Hadamard), succeeding where attention-based allocation methods fail. The resulting training-free protocol, requiring ~35 GPU-minutes, recovers up to 97% of lost alignment at under 1% latency and minimal memory overhead, addressing vulnerabilities confirmed in production vLLM serving with FP8 KV cache on NVIDIA GPUs.
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI); Emerging Technologies (cs.ET) |
| Cite as: | arXiv:2606.09864 [cs.LG] |
| (or arXiv:2606.09864v3 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2606.09864 arXiv-issued DOI via DataCite |
Submission history
From: Adarsh Kumarappan [view email]
[v1]
Mon, 1 Jun 2026 02:02:20 UTC (1,284 KB)
[v2]
Sat, 8 Aug 2026 15:57:15 UTC (1,285 KB)
[v3]
Thu, 5 Nov 2026 05:19:21 UTC (1,296 KB)
来源：arXiv cs.AI · arxiv.org