What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains

Summary

This research examines whether quantized GGUF models on Hugging Face can be independently re-derived from their published information. Across the 200 most-downloaded GGUF repositories (198 in scope), none record the build environment, so the Independent Verifiability Rate under a recorded-inputs protocol is 0/198. On four repositories that disclose their inputs, two omitted coordinates, the floating-point-contraction setting and the per-tensor quantization recipe, reproduce 7 of 8 target-quant files bit-for-bit on x86.

Related items

• HighCVE-2026-86063: Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow…Similar attack · NVD/CVE Database
• MediumOver 1,500 npm packages exposed by Trusted Publishing validation flawSimilar attack · CSO Online
• InfoSkillScreen: High-Recall Screening of Malicious Agent Skills with Decision ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-108958: TensorLayer HDF5 model loading deserialization via model_config argumentSimilar attack · NVD/CVE Database
• InfoIntroducing Security for AI Coding Agents and Workstations | Endor LabsSimilar attack · Endor Labs Blog