From Base to Fine-Tuned to Quantized: A Lifecycle View of Model Integrity

Stage 1: The base model

The base model is a capability substrate with essentially no alignment. It's not the thing you ship, but it's the thing everything downstream inherits from — its knowledge, its biases, and the raw capabilities that alignment will later try to constrain. The integrity question here is mostly about provenance and what's latent in the weights. It's the foundation; the interesting failures come later, when you start transforming it.

Stage 2: Base → fine-tuned

This is where alignment goes in, and it's the most-studied transition — but it's studied narrowly. Fine-tuning for safety is where you install the guardrails, and the method you use shapes the guardrails you get. DPO, RLHF, and Constitutional AI each install a different kind of alignment with a different characteristic gap (DPO vs. RLHF vs. Constitutional AI). Whatever method you pick, the alignment you get is shallow and data-bounded — it covers the distribution you trained on and thins out past it.

And it isn't free. Safety fine-tuning extracts a safety tax — capability lost to over-refusal and general degradation — that most teams never measure (The Safety Tax). So even at this well-trodden stage, integrity is two-sided: did you gain the refusals you wanted, and what did they cost you?

The integrity question at this stage isn't "did the loss curve converge." Convergence means training stopped, not that the model is safe to hand off (Post-Training Isn't Done When the Loss Curve Flattens). The real question is whether the alignment holds under pressure — which you only find out by red-teaming it, off-distribution and multi-turn, before your users do (Red-Teaming Your Fine-Tune Before Your Users Do).

The evaluation lens that applies at every stage

Before going further down the lifecycle, one thing has to be said about how you evaluate at each stage, because it's the same lesson everywhere: single-turn evaluation is a first impression, and the failures live in the conversation. In our adversarial evaluation of open-weight small models, the same models that passed single-turn refusal checks folded under multi-turn escalation (What Multi-Turn Escalation Taught Me About Single-Turn Evals).

That finding isn't specific to one stage. It's the lens you carry through all of them. At every transition below, "did integrity survive" has to be answered with multi-turn, adversarial, semantically-judged evaluation — not a single-turn refusal check that measures how the model behaves on its best behavior.

Stage 3: Fine-tuned → quantized

This is the transition almost nobody guards, and it's the one I think about most. You aligned the model, evaluated the aligned checkpoint, and then — to fit the hardware — someone quantized it to INT4, checked that perplexity and MMLU held, and shipped. But alignment is a thin, low-magnitude, low-redundancy layer, and aggressive quantization sands exactly that layer hardest. The result is quantization-aware safety drift: a model whose reasoning survives compression while its refusals quietly regress (Quantization-Aware Safety Drift).

The trap is that every quantization QA metric is a capability metric, and capability preservation is not safety preservation. The checkpoint you evaluated is not the artifact you shipped, and the divergence happened at a step no one was watching for safety. This is the sharpest illustration of the whole thesis: same weights, one compression pass, different safety profile.

Stage 3b: The distillation branch

Many small models don't reach production by quantizing a fine-tune — they're distilled from a larger, aligned teacher. And distillation raises its own integrity question, because a student learns what the teacher does on the prompts it's shown, and distillation corpora are built to transfer capability, not refusals. Whether alignment survives the teacher-student handoff is an open, measurable question — and "we distilled it from a safe model" is a hypothesis, not a warranty (Does Safety Alignment Survive Distillation?).

Why small models make the whole lifecycle riskier

Everything above is worse at small scale. Small models fail differently than frontier models — less redundancy, sharper cliffs, thinner alignment, worse multi-turn robustness — and they happen to be the model class that gets quantized most aggressively, distilled most often, and fine-tuned by the teams with the least safety infrastructure (Why Small Language Models Fail Differently Than Frontier Models). The lifecycle risks compound precisely where the models are thinnest and the oversight is lightest.

What re-establishing integrity actually requires

If integrity is a lifecycle property, then the operational conclusion is simple to state and rarely followed: re-evaluate at every transformation, on the actual artifact, with an adversarial multi-turn battery.

That requires a system, not a spreadsheet. Building an eval harness that can do this reliably — coverage as a grid, a semantic judge instead of keyword matching, a completeness gate so silent failures don't masquerade as passes, and a gateable, auditable verdict — is its own engineering discipline (Building an Adversarial Eval Harness for SLMs). Because the whole point of a lifecycle view is that you're not evaluating once; you're re-establishing integrity every time the model changes, which means the evaluation has to be repeatable enough to actually run every time.

Two kinds of integrity claim

One distinction the lifecycle view makes unavoidable: what you can claim depends on what you can pin down. A set of frozen weights you've evaluated can carry a durable integrity result — you know exactly what you tested. A mutable API endpoint cannot: it can change under you, so the strongest honest claim about it is a point-in-time screening, not a durable certificate. Integrity claims have to match the mutability of the thing they describe. Weights get certified; endpoints get screened. Conflating the two is how "we tested it once" turns into a guarantee it was never entitled to make.

The thesis, one more time

Model integrity is not a checkpoint you clear once. It's a chain — base, fine-tuned, quantized (or distilled), served — and each link is a new model that can quietly break the one before it. Evaluating the first link and assuming the rest inherited the result is the single most common way a model that "passed" ends up failing in production.

From base to fine-tuned to quantized: you find what breaks at every stage, or your users find it for you at the last one.

SichGate stress-tests your SLM for adversarial failures across the whole lifecycle — from base model to fine-tuned to quantized — so integrity is something you re-establish at every stage, not something you assume from the first checkpoint.