You know how a building passes a fire inspection, then the new owner converts the third floor into a restaurant kitchen, punches through load-bearing walls for ventilation ducts, and nobody re-inspects the structure? That's what happens when you quantize, prune, or distill a large language model for edge deployment. The original model was evaluated for safety; the optimized derivative was evaluated for task accuracy. Nobody checked whether the safety properties survived the renovation. Li et al. frame this as "security drift" — the idea that optimization is not a neutral compression but an information transformation that reshapes internal representations, decision pathways, and trust boundaries. Quantization collapses floating-point precision, potentially flattening the subtle activation differences that distinguish safe from unsafe completions. Pruning removes neurons or attention heads, and there's no guarantee the removed capacity wasn't load-bearing for adversarial robustness. Knowledge distillation transfers behavior from teacher to student, but alignment guardrails are behavioral properties that may not transfer via the standard distillation loss. The paper's core contribution is a conceptual taxonomy, not an empirical result. The authors propose the term "optimization-induced attack surfaces" and categorize the risks across quantization, pruning, distillation, and low-rank adaptation (LoRA). They argue that each technique has a distinct failure signature: quantization creates numerical blind spots, pruning opens structural vulnerabilities, distillation may lose alignment fidelity, and LoRA's low-rank updates can introduce exploitable parameter subspaces. The framework is reasonable but remains at the level of threat modeling — no attacks are demonstrated, no defenses are benchmarked. What makes this worth reading is the gap it names. The edge-LLM deployment pipeline currently has a missing audit step: post-optimization security evaluation. Models are compressed, accuracy is checked on standard benchmarks, and the compressed model ships. The authors are correct that adversarial robustness, jailbreak resistance, prompt injection defenses, and differential privacy guarantees all need re-verification after optimization. The field broadly knows this in principle but lacks standardized methodology or tooling. The limitation is equally clear: this is a position paper with no experiments. There are no adversarial evaluations of quantized vs. full-precision models, no measurement of how pruning affects jailbreak success rates, no distillation fidelity metrics for alignment properties. The claims are plausible and well-argued but entirely theoretical. The paper reads as a research agenda, not a research result. The practical urgency is real. Edge LLM deployment is accelerating — Apple Intelligence, on-device Gemini Nano, Qualcomm's NPU stack — and the optimization-to-deployment pipeline is getting shorter and more automated. If security drift is a genuine phenomenon (and there's every reason to think it is), the window for establishing evaluation standards is now, before billions of devices run optimized models that were never re-audited. The authors position this within the broader cs.CR (computer security) literature but don't engage deeply with the existing adversarial ML work on quantization robustness (e.g., Bernhard et al. 2023 on quantization-aware adversarial training, or the growing literature on alignment tax in distilled models). The paper would be substantially stronger with even a small empirical demonstration — one quantized model, one jailbreak benchmark, one measured delta.
