IROS 2026Accepted

Recti-Q: Feature-Space Rectification for OOD-Robust Quantized Perception

Robust 4-bit perception, repaired in feature space. Compressing a vision model to 4 bits keeps its score on clean images but quietly costs it accuracy on noisy, foggy or unfamiliar ones. Recti-Q hands that accuracy back with a patch of a few kilobytes, and never touches the compressed model itself.

Hamidreza Yaghoubi Araghi^*Parastoo Pilevar^*Ming C. Lin

University of Maryland, College Park^* Equal contribution

Paper Code Results BibTeX

A stop sign under real-world corruptions is read correctly by a full-precision model, misread by the 4-bit quantized model, and read correctly again once the Recti-Q adapter is attached to the same quantized model. — **Figure 1.** A quantized perception stack can look healthy on clean inputs and still fail once the world gets noisy. Recti-Q attaches a small trainable branch (A, B) to the *same* frozen quantized model and restores the correct prediction — without touching the backbone or its memory footprint.

Abstract

Robotic perception pipelines increasingly rely on large vision backbones deployed on SWaP-constrained edge platforms, making post-training quantization (PTQ) attractive for real-time inference. However, while PTQ often preserves clean in-distribution accuracy, we show that it can substantially degrade reliability under deployment-relevant distribution shifts (e.g., sensor noise, severe weather, and novel operating environments), creating a Quantization-Induced Robustness Gap. Across foundational vision benchmarks (ImageNet-C and PACS), 4-bit PTQ models exhibit pronounced robustness degradation despite negligible ID accuracy loss. To address this, we propose Recti-Q, a lightweight feature-space rectification framework that freezes the quantized backbone and trains a small classifier-head LoRA adapter using only source data. Recti-Q is architecture-agnostic across CNNs and Transformers, supports efficient teacher-free training, and recovers a significant portion of the lost robustness, in some cases matching or exceeding FP32 performance. At less than 1% parameter overhead (as small as 6 KB), Recti-Q preserves over 99% of PTQ memory savings, adds negligible compute, and enables low-bandwidth Over-The-Air (OTA) resilience patching for deployed robotic fleets operating in unpredictable physical environments.

The finding in one picture

The test that ships the model cannot see the damage

DeiT-S · one model, two tests · longer bars are better

Same model, same weights, two different tests. Compressing DeiT-S to 4 bits costs 0.91 points on the clean benchmark — small enough that nothing in a normal release check would flag it — and 5.62 points once the picture is genuinely degraded. Recti-Q hands back 2.68 of those points without changing a single weight of the compressed model. Averaged over all four severe corruptions tested on this model the shape is the same: −4.47 points from compression, +0.94 recovered.

6 KBthe smallest patch that still works — about the size of a short email (0.34 MB for the one above)

99.4%of the memory that compression saved is still saved once the patch is attached

0weights of the compressed model are retrained — the patch ships on its own, over the air

The four terms behind those numbers

4-bit quantization (PTQ, written “W4”): Storing every weight of an already-trained network in 4 bits instead of 32. The model gets roughly three times smaller and runs faster on small hardware. Nothing is retrained — it is a compression step applied at the end.
In-distribution vs. out-of-distribution: In-distribution is the clean, well-lit test set a model is normally scored on. Out-of-distribution is the same objects seen through fog, sensor noise or motion blur, or drawn in an unfamiliar style. A robot meets the second kind.
ImageNet-C and PACS: The two standard out-of-distribution test sets. ImageNet-C re-photographs ImageNet through 15 kinds of camera and weather damage at five severities — we report the harshest, severity 5. PACS trains on photos, art and cartoons and then asks for sketches.
“Points” of accuracy: Accuracy is a percentage of images classified correctly, so a change in it is quoted in percentage points: going from 33.84% to 36.52% is a gain of 2.68 points.

The problem

Clean accuracy is not a safety check

Quantize a vision backbone to 4 bits and the standard validation number barely moves — under 1 pp on ImageNet for every DeiT model we test, and nothing at all on the PACS in-distribution split. A developer reading only Table 1 would ship it.

The damage shows up somewhere the release checklist does not look. On the same models, held-out domains and severe corruptions lose several points of accuracy that the full-precision model keeps. We call this the Quantization-Induced Robustness Gap, and it grows with the severity of the shift — exactly the regime an embodied system meets in bad weather or poor light.

Table 1 · PTQ preserves in-distribution accuracy

Percentage of clean test images each model identifies correctly. Compressing to 4 bits changes almost nothing here — that is exactly the trap.

Model	PACS (clean)		ImageNet (clean)
Model	original	4-bit	original	4-bit
ResNet-50	94.99	94.87	80.38	80.31
DeiT-T	94.48	94.26	72.16	71.54
DeiT-S	96.38	96.38	79.85	78.94
DeiT-B	97.21	97.55	81.98	81.50

The worst of the eight comparisons loses 0.91 points (DeiT-S on ImageNet); DeiT-B is actually 0.34 points better after compression. Every chart below uses these same compressed models.

The worse the picture gets, the more compression costs you

DeiT-S · accuracy the 4-bit model gives up against the uncompressed one, at three levels of image damage

mild damagemoderatesevere

The damage stays hidden until the picture is genuinely bad. On mildly degraded images the compressed model gives up less than 1.9 points. On the harshest ones it gives up as much as 5.62. On the clean test set it gives up 0.91 (Table 1) — the only number a normal release check would look at.

The method

Rectify the features, leave the backbone alone

The failure happens one step before the answer. Compression distorts the internal description a model builds of an image, so the final decision layer — unchanged — now sits in the wrong place relative to it. Recti-Q learns a small correction to that description, trained on ordinary clean data only.

z = z_q + (α/r) · B(A(u))

u pre-classifier featuresz_q frozen W4 logitsA, B LoRA projections, B zero-initr = 64, α = 16

Equivalently, Recti-Q induces a low-rank update to the frozen head itself, z = (W_q + (α/r)BA) u. Because B is zero-initialized, training starts exactly at the quantized model and can only move away from it deliberately. Training minimizes L = L_CE + λ·L_KD against a frozen FP32 teacher (T = 4); λ = 0 is the teacher-free variant, and it is often the stronger one (Table 4).

Recti-Q framework: a frozen quantized student and an optional frozen full-precision teacher, with a trainable LoRA adapter summing into the logits; the training branch computes cross-entropy and KD losses. — **Figure 2.** Training (right) and inference (left). Both backbones stay frozen; only A and B are trained. At inference the teacher is discarded and the adapter rides along on the same forward pass.

STEP 01

Compress

Take a trained model down to 4-bit weights with off-the-shelf post-training quantization (torchao, HQQ). No calibration set, no retraining — the standard, boring way it is done in practice.

STEP 02

Freeze

Lock the compressed model and never touch it again. No fine-tuning, no quantization-aware retraining, no second copy of the weights on the device.

STEP 03

Rectify

Train one small extra branch that reads the features the model computes just before its final decision, and nudges that decision. Two matrices, and they are the only thing that learns.

STEP 04

Patch

Ship that branch on its own — 6 KB to 0.34 MB. A robot already running the compressed model downloads it the way a phone downloads a security update.

Source-only and leakage-free. Adapters for ImageNet-C are trained on a fixed 5% class-balanced subsample of the ImageNet-1k train split and model-selected on the clean val split; PACS uses leave-one-domain-out with the three source domains. No corrupted image and no target-domain image is seen during training or selection.

Results

A kilobyte-scale patch buys back points of robustness

Three things are compared everywhere below: the original uncompressed model, the same model compressed to 4 bits, and that compressed model with the patch attached. Sizes are for the whole file you would put on a device, so the last three columns of each table are the efficiency claim in full.

The patch gives back a large share of what compression took

DeiT-S on the harshest version of each corruption · percentage of images identified correctly

original, uncompressedcompressed to 4 bitscompressed + Recti-Q patch

Every corruption improves, and the worst one improves the most. Low contrast costs the compressed model 5.62 points; the patch hands back 2.68 of them — close to half — and costs 0.34 MB to do it. Exact values in Table 2.

Table 2 · ImageNet-C (severity 5)

Percentage of severely corrupted images identified correctly — plus the size of the file you actually ship to the device.

Model	Corruption	Images identified correctly (%)			Change (accuracy points)		Size on device (MB)
Model	Corruption	original	4-bit	+ patch	cost of compressing	won back by patch	original	4-bit	+ patch
DeiT-S	contrast	39.46	33.84	36.52	−5.62	+2.68	84.17	26.16	26.50
DeiT-S	gaussian noise	33.18	28.88	29.30	−4.30	+0.42	84.17	26.16	26.50
DeiT-S	shot noise	30.36	26.30	26.67	−4.06	+0.37	84.17	26.16	26.50
DeiT-S	impulse noise	32.82	28.92	29.19	−3.90	+0.27	84.17	26.16	26.50
ResNet-50	impulse noise	19.83	19.68	27.04	−0.15	+7.37	97.79	91.02	91.77

The DeiT-S patch adds 0.34 MB to a 26.16 MB compressed model, so 99.4% of the memory saved by compression survives. ResNet-50 is the honest caveat: it is a convolutional network, and our 4-bit step only touches its fully-connected layers, so compression barely hurt it in the first place (−0.15). Its +7.37 is therefore a genuine robustness gain, not a repair — and, as the next figure shows, it does not come for free on every kind of damage.

Table 3 · PACS, leave-one-domain-out

PACS holds one visual style out entirely: the model trains on the other three and is then asked about the one it has never seen.

Model	Target domain	Images identified correctly (%)			Change (accuracy points)		Size on device (MB)
Model	Target domain	original	4-bit	+ patch	cost of compressing	won back by patch	original	4-bit	+ patch
DeiT-S	sketch	68.59	64.57	65.74	−4.02	+1.17	82.71	25.64	25.74
DeiT-T	cartoon	73.08	71.72	73.34 †	−1.36	+1.62	21.13	15.59	15.64
DeiT-T	art painting	74.90	73.63	75.15 †	−1.27	+1.52	21.13	15.59	15.64
DeiT-S	art painting	88.38	87.21	88.28	−1.17	+1.07	82.71	25.64	25.74
ResNet-50	sketch	72.46	72.42	73.30 †	−0.04	+0.88	90.03	90.03	90.53

† the patched compressed model beats the uncompressed original on this row. That is recalibration, not new knowledge: the patch straightens a decision boundary that compression bent, and the frozen backbone still caps what is recoverable. Averaged over four training runs, ResNet-50 on sketches gains +0.88 ± 0.53 points.

It helps most where the picture gets noisy, and costs a little where it gets soft

ResNet-50 · how many points of accuracy the patch adds or removes, against the compressed model with no patch

patch helpspatch hurts

The direction depends on the kind of damage, and it is reliable. Grain, dead pixels, haze and frost — the failures a camera actually has at night or in bad weather — gain 6 to 12 points. Blur and over-exposure lose 3 to 4. Repeating the training with four different random seeds moves each bar by at most 0.43 points, so these are properties of the method, not luck. Eight further corruptions are left out for readability; every one sits between +0.25 and −2.59, i.e. inside the range shown here (full table in the repository).

Breakdown point. On DeiT-S, W3 still holds 73.61% ID accuracy and Recti-Q lifts mean OOD accuracy over the four corruptions above from 12.05% to 14.24% (+2.19 pp). At W2 the ID accuracy collapses to 4.61% and recovery falls to +0.12 pp — the boundary between correctable feature distortion and genuine information loss.

Ablations

What the method actually needs

Three questions decide whether this is practical: does training the patch require keeping the big uncompressed model around, does the correction really have to happen where we claim it does, and how small can the patch be pushed.

Almost all of the benefit is there at the smallest size

DeiT-S asked to recognise sketches it never trained on · accuracy gained over the unpatched compressed model

A 6 KB patch already achieves 74% of what a 16× larger one does, and a 25 KB one achieves 91%. That is the deployment argument: a file this small can be pushed to robots already in the field over a slow or expensive link, the way a phone receives a security update. Rank is the single dial that sets the patch size.

Table 4 · Does training the patch need the uncompressed model?

Training the patch can be supervised by the uncompressed model. λ sets how much: λ = 0 means no teacher is used at all.

Model	Domain	4-bit, no patch	With the Recti-Q patch
Model	Domain	4-bit, no patch	λ = 0	λ = 0.5	λ = 1.0
DeiT-S	sketch	64.57	64.65	65.49	65.74
DeiT-S	art painting	87.21	88.28	87.68	87.71
DeiT-T	cartoon	71.72	73.34	72.87	72.85
DeiT-T	art painting	73.63	75.15	74.41	74.24

The no-teacher setting wins three of the four rows. So the patch can be trained on hardware that cannot hold the full-precision model in memory at all — which is the situation that matters in practice.

Table 5 · Does it matter where the correction goes?

Same data, same budget — the only difference is where in the network the correction is applied.

Where the correction is applied	Images correct (%)	gained
nowhere — 4-bit model as-is	64.57	—
on the final scores (logit-space MLP)	64.57	+0.00
on the features behind them (Recti-Q)	65.74	+1.17

Adjusting the model's final scores recovers nothing at all. The damage lives one layer earlier, in the features the scores are computed from, and that is where the correction has to go. This is the paper's central claim, and it is falsifiable in a single row.

Citation

Cite this work

BibTeX

@article{araghi2026recti,
  title={Recti-Q: Feature-Space Rectification for Out-of-Distribution-Robust Quantized Perception in Edge Robotics},
  author={Araghi, Hamidreza Yaghoubi and Pilevar, Parastoo and Lin, Ming C},
  journal={arXiv preprint arXiv:2607.18540},
  year={2026}
}

Read the paper Code & adapters