DEV Community

AI OpenFree
AI OpenFree

Posted on

AX-RAY: VIDRAFT's Causal Leakage Auditing Framework for Hybrid Sequence Models

#llm #machinelearning #ai #opensource

AX-RAY: VIDRAFT's Causal Leakage Auditing Framework for Hybrid Sequence Models

TL;DR: VIDRAFT has published a diagnostic method that detects causal leakage — the unintended flow of future-token information into earlier positions — across attention, state-space, and hybrid autoregressive models. Applied to public models, the technique identified leakage in Nemotron-H-8B and Zamba2-1.2B while injecting 192 synthetic faults and catching every single one at layer granularity. The research is now integrated into VIDRAFT's AI safety diagnostic system, AX-RAY, and is being positioned as a verification technology for government-backed security-specialized foundation model programs.

What it is

VIDRAFT (비드래프트) is a Korean Pre-AGI AI startup focused on AI safety and diagnostics. On August 24, 2026, the team published a paper on arXiv titled "The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models", introducing a principled diagnostic framework for detecting causal leakage in autoregressive language models.

Causal leakage is the structural defect that occurs when information from future token positions illegitimately influences the internal representations of earlier positions — violating the core causality guarantee that autoregressive models depend on for correctness and trustworthy evaluation.

The core insight: traditional causal verification simply checks whether the attention causal mask is applied correctly. That's no longer sufficient. Modern architectures increasingly combine attention layers with state-space models (SSMs), recurrent operators, convolutions, and chunked scan mechanisms, each of which introduces independent execution paths where future information could silently leak through — paths that a mask-only audit would never catch.

The research findings are being commercialized and integrated into AX-RAY, VIDRAFT's AI safety diagnostics system. The company has also filed and requested examination of a domestic (Korean) patent covering the underlying technology prior to the paper's public release.

How it works

The diagnostic method is conceptually elegant and computationally lightweight:

  1. Two forward passes, one difference. The auditor constructs two inputs that are identical except at the final sequence position, then runs each through the model independently.
  2. Prefix invariance check. In a correctly implemented autoregressive model, changing a future token cannot alter the internal representations of earlier positions. If it does, that is the signature of causal leakage.
  3. Layer-level localization. By comparing internal activations layer by layer across both forward passes, the method pinpoints the exact layer where causality first breaks — without requiring any gradient computation or model retraining.

This design means the audit is:

  • Training-free — no fine-tuning, no backprop
  • Architecture-agnostic — applicable to pure attention, SSM, and hybrid models alike
  • Precise — localizes leakage to a specific layer rather than just flagging the model as a whole

For hybrid models using chunked scan operations, the team also performed static code analysis of the relevant open-source library implementations to identify discrepancies in how input and output chunk axes are processed — then validated those findings empirically on real model weights.

AX-RAY extends this beyond a one-off audit: it aims to systematically verify that a model's benchmark scores, execution code, and architectural structure all behave as designed — flagging abnormal causal dependencies or structural risk paths that could compromise the integrity of evaluation results.

Benchmarks & results

The paper reports the following publicly disclosed findings:

  • 192 synthetic causal faults were artificially injected across diverse fault types into test models. The traditional mask-inspection approach detected none of them. The new prefix-invariance diagnostic detected all 192, localized to the layer level.
  • Nemotron-H-8B (NVIDIA) and Zamba2-1.2B (Zyphra): causal leakage confirmed in their PyTorch execution paths.
    • In Zamba2-1.2B, leakage begins at the model's declared chunk size of 256.
    • In Nemotron-H-8B, leakage begins at chunk size 128.
  • No leakage detected in: Bamba-9B, Falcon-H1, Granite-4.0-H, Mamba2, and RecurrentGemma under the same diagnostic conditions.
  • The team also analyzed the chunked scan implementation in the open-source transformers 5.7.0 library and identified a discrepancy in chunk-axis handling between reference and specific implementations.

VIDRAFT notes that causal leakage has direct implications for evaluation integrity: if future information seeps into earlier positions during training, metrics like cross-entropy loss and perplexity (PPL) may appear artificially better than a correct implementation would produce.

How to try it

The underlying paper is publicly available on arXiv (published August 24, 2026). Search for: "The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models".

As of the date of this article, AX-RAY is not publicly available as a self-serve tool — it is being deployed in the context of government-backed security-specialized foundation model validation programs in Korea. There are no public Hugging Face model cards, GitHub repositories, or OpenAI-compatible API endpoints announced for AX-RAY at this time.

Developers interested in the technology or potential access should monitor VIDRAFT's official channels for future announcements.

FAQ

Q: Why isn't checking the causal mask enough for modern models?
A: The causal mask only governs attention score computation. Hybrid models contain additional execution paths — SSM recurrences, convolution kernels, and chunked scan operators — that the mask does not touch. Future tokens can leak through any of these paths without ever triggering a mask-based check.

Q: Does this diagnostic require access to model weights or training data?
A: No. The method only requires the ability to run two forward passes through the model and inspect intermediate layer activations. No gradients, no training data, and no weight modification are needed.

Originally reported by 이코노미스트 (2026-08-26) — source article.

Top comments (0)