{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0217",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Community quantisations can alter model safety behaviour relative to upstream weights.",
  "details": "## What the vulnerability is\n\nQuantisation can be a model-supply-chain boundary rather than a neutral compression step. R7 cites the LLM Quantization Attack work showing a model that is benign in fp16 can become malicious under standard GGUF, GPTQ, or AWQ paths, and cites HarmLevelBench reporting increased direct-attack vulnerability under AWQ/GPTQ for Vicuna-13B. Neither source supplies a single ACVE-ready per-model ASR for the arbitrary community artefact in this row. This is a qualitative supply-chain candidate, not evidence that every quantisation is poisoned.\n\n## Which configuration is exposed\n\nThe match is a locally quantised model whose HF source repository is not the upstream organisation, used by any agent with tools. A recognisable case is a community GGUF downloaded for an Ollama or llama.cpp agent, with a shell, file, browser, or network tool attached and no provenance check on the weights, template, or tokenizer. The model supplier is the attacker; sideEffect and egress determine how changed behaviour can cause harm, but approval may be present or absent.\n\n## How ACVE detects it\n\nACVE checks that model.quant exists and that a sideEffect tool exists. It does not yet prove the upstream organisation or compare file contents, so a community quant match is possible until model.digest, source, and provenance are recorded. A server that hides its tools is also possible. Runtime alignment changes are not inferable from the quant string; safeguards can describe a classifier, but they cannot certify the artefact’s provenance.\n\n## Fix\n\n1. Reconfigure model.digest to an upstream-published, content-addressed quantisation from a trusted registry or signed supplier. 2. Record weights, tokenizer, template, and parameter-layer digests separately. 3. Run the safe-fixture evaluation on the exact quantised artefact before connecting side-effecting tools. 4. Keep approval enabled while validating and reject a digest change as a new model, even if the tag is unchanged.\n\n## Grounding needed\n\nPin the upstream fp16 commit, community quantiser repository and commit, GGUF/GPTQ/AWQ file digest, template and tokenizer, serving stack, tool set, and safe-fixture prompts. R7 confidence is L: the cited research establishes a supply-chain mechanism and qualitative vulnerability changes, but no row-specific field measurement exists. Severity is LOW because no attacker-budget ASR is available; a reproduction must create the missing paired measurement rather than invent one.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "any"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://github.com/eth-sri/llm-quantization-attack"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/abs/2411.06835"
    }
  ],
  "database_specific": {
    "severity": "LOW",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "supply-chain"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI04"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "tool-provider",
        "vector": "supply-chain",
        "outcome": "policy-violation"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "LLM Quantization Attack",
          "benchmarkVersion": "2024",
          "attack": "malicious behavior introduced through quantisation",
          "defense": "none",
          "metric": "asr",
          "model": {
            "id": "model-specific artefacts in study",
            "quant": "GGUF/GPTQ/AWQ"
          },
          "setup": {
            "tools": [
              "agent tools unspecified"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://github.com/eth-sri/llm-quantization-attack",
          "note": "PoC/mechanism; no row-specific ASR"
        },
        {
          "kind": "eval",
          "benchmark": "HarmLevelBench",
          "benchmarkVersion": "2024",
          "attack": "direct attack under AWQ/GPTQ",
          "defense": "none",
          "metric": "asr",
          "model": {
            "id": "Vicuna-13B",
            "quant": "AWQ/GPTQ"
          },
          "setup": {
            "tools": [
              "agent tools unspecified"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/abs/2411.06835",
          "note": "secondary source; qualitative ASR increase; no row-specific value"
        }
      ],
      "matcher": {
        "all": [
          {
            "field": "model.quant",
            "op": "exists"
          },
          {
            "some": "tools",
            "where": {
              "field": "sideEffect",
              "op": "eq",
              "value": true
            }
          }
        ]
      },
      "fix": {
        "summary": "Pin model.digest to an upstream-published quantisation and rerun the safe fixture.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "model.digest",
            "to": "upstream-published quantisation",
            "why": "Content-addressed upstream weights make a community quantisation swap visible and reviewable."
          }
        ]
      }
    }
  }
}