Quantization is a selective forgetter, not a privacy defense.

Bits and Memories measures verbatim reproduction of training data rather than membership inference, using Pythia models with known-memorized sequence sets across five precision levels down to four bits. Verbatim memorization drops faster than perplexity at every precision and size under two unrelated quantization algorithms. But at the largest model studied, four-bit quantization still reproduces most memorized sequences while giving up a few percent of capability, and the surviving memorized fraction grows with model size.