Quantized Guardians: Accuracy-Neutral Decision Churn in Compressed Prompt-Injection Detectors

Extended version (v3) with native INT8 (PyTorch, ONNX Runtime) on x86_64 and aarch64 CPUs, GPTQ/AWQ comparisons, full PIGuard grid, granularity ablation and multiple seeds. The artifacts zip contains code, CI workflow, per-input scores, run metadata and aggregate results; also at https://github.com/horizonbymuneeb/quantized-guardians/tree/main/v2 Classifier guardrails against prompt injection and jailbreaks are routinely compressed to low precision before deployment. The usual acceptance test for a compressed guardrail is that benchmark accuracy is unchanged. We show with paired experiments on four public detectors (ProtectAI-v2, PIGuard, Deepset, FMOps; 2,755 inputs) that this test is unsafe: compression can leave F1 and AUROC nearly intact while changing which attacks are blocked. Four-bit per-channel round-to-nearest quantization of ProtectAI-v2 changes 3.92% of decisions and lets through 51 attacks that FP32 blocked. The default one-line native dynamic INT8 paths (PyTorch, ONNX Runtime) are far worse: they flip 30.05% and 38.19% of ProtectAI-v2 decisions and 31.54% of PIGuard decisions, and PIGuard stops flagging any input as an attack (F1 = 0). A per-tensor fake-quantized simulation reproduces these failures, whereas the commonly used per-token simulation reports only 1.78% and 3.05% flips, so such simulations can badly understate deployed risk. An ablation attributes the collapse to per-tensor scales: per-tensor weights alone flip 36.7% of decisions and per-tensor activations alone 21.3% on a 150-input subset. Native INT8 on x86_64 CPU runners and on an aarch64 CPU produce flip rates within 0.4 points (ProtectAI-v2: 29.73% vs 30.05%) but still disagree on 117 of 2,755 individual decisions. GPTQ did not reduce churn relative to RTN for three of four detectors, and its flip sets varied across seeds (Jaccard 0.29–0.76). Re-tuning the threshold removes part of the shift but not input-specific churn. We propose an instance-level acceptance protocol for compressed security classifiers.