You compress models to cut inference cost and to run on-device. Your acceptance tests stay green: perplexity holds, task accuracy holds, the fidelity check holds. Then the model runs as an agent and adds a step to a procedure that nobody wrote. Agentic reliability is a separate axis, and the standard acceptance stack does not measure it.
The trade you think you are making
Compression is a good trade. A well-quantized model costs a fraction of the original to serve, fits smaller hardware, and keeps its quality on the benchmarks you track. The assumption underneath is that if the numbers hold, behavior holds. For agents, that assumption breaks.
We measured it. A gently-compressed model that sits inside the standard perplexity acceptance band invents procedure steps when it executes a standard operating procedure, at a rate its uncompressed twin never shows. The benchmarks that approved the build cannot see the failure, because none of them test whether the model follows a procedure faithfully.
Why your current gates miss it
- Perplexity and task accuracy average over tokens and questions. A model can hold its average and still drift on the narrow behavior of copying an instruction exactly.
- Fidelity probes measure representational similarity. They confirm the compressed weights still look like the originals. They say nothing about procedure adherence, and we found builds that win the fidelity check and fail the behavior test on the same weights.
- The failure depends on the compression method, not the amount of damage. Coherent low-rank compression triggers it; pruning to the same quality does not. Two builds that look identical on every dashboard behave differently in an agent.
What the failure costs in production
An agent that invents a step is worse than one that refuses. It produces a fluent, plausible, wrong procedure that a downstream system or a person may execute. In a compliance workflow, a customer-operations runbook, or a tool-using assistant, a fabricated step is a fabricated action. The build passed every check you had, so nothing flagged it before it shipped.
The fix is cheap and data-free
The failure has a clean signature. It tracks the coherence of the compression error times its rate, and two numbers read straight off the weights predict it. The screen needs no benchmark data and no test generations. It runs in the build pipeline, right after compression, and flags a model before it reaches an agent.
| What you get | Standard acceptance stack | With the agent-safety screen |
|---|---|---|
| Cost savings from compression | Yes | Yes |
| Perplexity / accuracy held | Yes | Yes |
| Agentic procedure reliability checked | No | Yes |
| Extra labeled data required | none | None |
You keep the economics of a compressed model and add the one guarantee the benchmarks were missing. Standard mixed-precision quantization passes the screen, so it does not slow your safe builds down. It catches the aggressive and low-rank builds that would otherwise ship unnoticed.
What we recommend
- Treat compression-acceptance and agent-deployment as two separate gates. A model can be good enough to serve and not good enough to act.
- Add a behavioral check for anything that executes procedures. Averaged benchmarks will not surface procedure invention.
- Screen every build before deployment. The check is a two-minute, data-free pass in your pipeline, not a research project.
The finding is peer-reviewable and public: the paper and the open-source screen are available now.
This safeguard is built into our products.
Every model Black Sheep AI ships through Watchman and Shepherd clears the agent-safety screen before it reaches production. You get the cost of a compressed model and the reliability of the original, checked automatically, with no benchmark data required. If you run your own compression pipeline, the screen is open source and drops in as a pre-flight gate.
Based on Black Sheep AI research across Qwen3-8B, Mistral-7B, and Llama-3.1-8B. Full method and confidence intervals in arXiv:2607.28196.
