A scale-dependent zero point silently corrupts UINT8 affine quantization in nntrainer

Three values expose the failure

At nntrainer source revision a7ea056e79ab8e14447ea305c1b634e233343258, automatic UINT8 affine quantization of [-127.5, 0, 127.5] returns:

scale = 1
zero_point = 0
q = [0, 0, 128]
dequantized = [0, 0, 128]
maximum absolute reconstruction error = 127.5

The independent ONNX affine reference records zero_point=128, codes [0,128,255], reconstructed values [-128,0,127] and maximum error 0.5. The negative endpoint and real zero collapse into the same code in the implementation.

The dimensional check

The reviewed implementation constructs the zero point using round(scale * min) + 128. An affine zero point instead follows a ratio such as qmin - min/scale, with the chosen rounding and saturation policy. Under a positive change of units x → a*x, both the minimum and scale change by a. Their ratio stays fixed, while their product changes by a².

Recorded correction and controls

The public evidence package includes a candidate production patch, captured output from the actual nntrainer test binary and FIX_VALIDATION.md, which records a successful build and 15 passing local quantizer tests. The candidate includes real zero in the inferred unsigned range and applies the ratio formula. Tests cover unsigned types, one-sided ranges and a change of units. Existing positive unsigned tests supplied scale and zero point directly, bypassing the faulty automatic path.

Corrected hypothesis

An initial claim that UINT4 dequantization returned shifted values was disproved by the recorded runtime test: the reviewed path throws earlier while copying UINT4 data into FP32. That rejected hypothesis is preserved in the original report.

Evidence and boundaries

This is a correctness result at a pinned source revision. It does not establish a security vulnerability, a failure in every model or device, or absolute novelty. The original search was bounded to the channels checked on 3 September 2026. Current upstream review and release status must be checked through the linked issue and pull request.

Pinned report, reproduction, oracle and patch · Unmodified public evidence archive

Original upstream issue #4324 · Candidate correction #4331 · Existing LinkedIn publication

Evidence ZIP SHA-256: 8e53c6e57e456a691b44b4cbf6a0aa0e723c3e15837fcce5fd11dffff35450b2. Archival preparation used AI assistance. Code and copied material retain their original notices.