Beyond Perplexity: Multi-dimensional Safety Evaluation of LLM Compression (2024)

Abstract: Increasingly, model compression techniques enable large language models (LLMs) to be deployed in real-world applications. As a result of this momentum towards local deployment, compressed LLMs will interact with a large population. Prior work on compression typically prioritize preserving perplexity, which is directly analogous to training loss. The impact of compression method on other critical aspects of model behavior—particularly safety—requires systematic assessment. To this end, we investigate the impact of model compression along four dimensions: (1) degeneration harm, i.e., bias and toxicity in generation; (2) representational harm, i.e., biases in discriminative tasks; (3) dialect bias; and (4) language modeling and downstream task performance. We examine a wide spectrum of LLM compression techniques, including unstructured pruning, semi-structured pruning, and quantization. Our analysis reveals that compression can lead to unexpected consequences. Although compression may unintentionally alleviate LLMs’ degeneration harm, it can still exacerbate representational harm. Furthermore, increasing compression produces a divergent impact on different protected groups. Finally, different compression methods have drastically different safety impacts: for example, quantization mostly preserves bias while pruning degrades quickly. Our findings underscore the importance of integrating safety assessments into the development of compressed LLMs to ensure their reliability across real-world applications.

## introduction large language models (e.g., @xcite are remarkably performant across various tasks; they have been deployed not only as intelligent assistants, but also in high-stake scenarios such as psychology @xcite and medical diagnosis @xcite . the sensitivity of such applications necessitates evaluating them across multiple dimensions, including accuracy, robustness, and other factors @xcite . despite potential usefulness, high computational costs render local llm deployments difficult (cf. @xcite . consequently, there has been a surge of interest in compression methods that convert llms into compact models for efficient storage and inference by reducing their latency as well as memory footprint (e.g., @xcite @xcite @xcite . pruning algorithms like @xcite and wanda @xcite can substantially reduce the number of active llm parameters without compromising perplexity. similarly, quantization methods (e.g., @xcite @xcite can reduce the memory footprint of llms by reducing bit-precision during inference without significantly impacting perplexity. model compression methods primarily focus on ensuring that the perplexity of the compressed models does not deteriorate. however, solely relying on perplexity as a performance metric is insufficient. for example, compressing large language models by a small fraction (e.g., a 20% reduction) may result in minimal changes in perplexity, but can lead to significant degradation in performance on downstream tasks @xcite . more importantly, there is a lack of systematic evaluation of how compression affects an llm along safety dimensions, such as bias, toxicity, and truthfulness. in this work, we argue that usage costs and data sharing restrictions will mean that local deployments of compressed llms are more likely to impact a larger population. given their potential widespread use, we ask: are compressed llms not only accurate, but also safe? to this end, we conduct a multi-faceted evaluation of compressed llms, including: (1) evaluating its degeneration harm, i.e. toxicity and bias in model generated text; ## background in this section we discuss background knowledge about potential harms by llms and existing llm compression methods. ## evaluating compression models we study two base models: llama-2 @xcite and @xcite of two different sizes: 7b and 13b parameters. llama-2 is an autoregressive language model pre-trained on 2t tokens, while tülu-2 is based on llama-2 and supervised fine-tuned (sft-ed) on the tülu-2-sft-mixture @xcite . we evaluate both the raw language models and their @xcite compression method calibration data calibration criteria weight update pruning magnitude ✗ weight ✗ sparsegpt ✓(128) weight ✓ wanda ✓(128) weight×act. ✗ gblm ✓(128) weight×act.×grad. ✗ quantization llm.int8() ✗ weight ✗ gptq ✓(128) weight×act. ✓ awq ✓(128) act. ✓ instruction-following variants. foot_2 ## degeneration harm & representational harms existing bias and toxicity evaluation benchmarks (e.g., @xcite @xcite focus on providing one single metric macro averaged over different datasets. in contrast, we take a closer look at what can be lost in the single average scores, and focus on degeneration and representational harm. ## how does compression affect different protected groups? the bbq score for representational harm is aggregated across multiple different kinds of protected groups. we see in fig. 1c that the score does not have substantial change across compression ratios. at the level of individual protected groups, this is not the case. we find, however, that the change of harm score against individual protected groups shows no clear pattern. in fig. 2 , we select sparsegpt as a representative pruning method to show the change of model's bias against each individual group as the compression ratio increases. although the aggregated bias metric shows no drastic change, the bias metric against each individual group may change significantly with a 10% compression rate difference. moreover, quantization methods also demonstrate different bias changing patterns against different groups. for example, on bbq dataset, llm.int8() has a +9.4 (increased bias) against the age protected group with llama-2-13b model, and -1.2 (decreased bias) against race_x_gender while awq has +10.6 and -1.5. our finding highlights the necessity for finegrained bias evaluation for different demographic groups, instead of relying on aggregated metrics. in addition, practitioners should evaluate their (compressed) llms with a focus on their users' demographic groups. ## how does compression affect different dialects of english? different prior works have studied dialect biases for language models @xcite @xcite . @xcite highlight that llms may encode systemic racial biases via dialect prejudice. in this section, we study how compression affects language models' dialect biases. specifically, we focus on african american english (aae) versus "standard" english. we use two paired although aggregated bias metric are relatively stable, different protected groups have vastly different behaviors. results with 7b models show similar trends (fig. 6 ). figure 3 : llama-2-13b perplexity (↓) evaluation results for dialect bias. note that awq and gptq have close results thus their markers are overlapped in the plots. llama-2-7b shows similar trends (fig. 7 ). twitter aae dataset (blodgett et al., 2020), consisting of balanced sets of tweets classified as african american or white-aligned english; (2) the aae litera-ture dataset foot_4 versus dolma books subset (soldaini et al., 2024). the first comparison focuses on social media posts while the second comparison focuses on public domain books, representing (typ- we show the results with llama-2-13b base model in fig. 3 . the full results are in appx. d.3. we make three key observations: (1) the pre-trained language model has a dialect bias. it has a lower perplexity on standard english book text or social media posts, compared to their african american english counterparts. (2) model compression maintains the language model's dialect biases. the perplexity of both aae and "standard" english increases as the compression ratio increases, but the margin does not reduce. this is true for both pruning and quantization methods. (3) even a heavily compressed model (at 50% pruning ratio) has better perplexity on "standard" english than the uncompressed model on african american english. notwithstanding the difficulty of the selection of the perplexity evaluation dataset and the underlying phenomenon of dialect bias, our conclusions remain valid because of the significantly worse perplexity of aae dialect with the uncompressed model. the impact of the last observation can be illustrated by mapping model size to monetary cost of inference; larger models cost more. the largest (i.e. uncompressed) model is double the size of the 50% compressed model, but the former has worse perplexity on aae than the latter on standard english. as language models are increasingly becoming our interfaces to data and compute, this means that a speaker of white-aligned english can receive "better service" in their native dialect, but pay only half the price as an aae speaker seeking to interact in their native dialect. ## the impact of supervised fine-tuning in this section, we investigate how the order of performing pruning and sft affect the resulting model's performance. 6 for the experiment group, we first prune the base llama-2-7b model to 50% pruning rate, then perform supervised finetuning. for the control group, we first sft the base model then perform the pruning. we refer to the experiment group as @xmath0, and the control group as @xmath1. we use the all four pruning algorithms from sec. 2.2, and the tülu-2-sft-mixture foot_6 used by the official tülu family models for the supervised fine-tuning. ## conclusions and recommendations in this work, we presented a comprehensive evaluation on the safety of llm compression techniques. we systematically investigated multiple aspects of safety, including degeneration harm, representational harm as well as dialect biases. our safety evaluation, along with downstream task performances, reveals that model compression can lead to a series of unexpected results. compression may unintentionally remedy an llm's degeneration harm, but it can still exacerbate representational harm. in addition, as the compression rate increases, different protected groups are not affected equally. our findings highlight the need for a nuanced understanding of how compression affects llm behavior. we conclude with the following recommendations for future llm compression research: (1) do not solely evaluate one aspect, perplexity or safety, in isolation. instead, always measure and report both. (2) aggregated metrics for safety can hide the nuanced movement across different protected groups and dialects. it is imperative to conduct fine-grained evaluations of compressed llms with regard to each individual protected group and dialect.