Causal Leakage in Autoregressive LLMs: How VIDRAFT's AX-RAY Audits Foundation Model Integrity

TL;DR: VIDRAFT published a preprint demonstrating that causal leakage — where future token information contaminates earlier computations in autoregressive models — can exist even when causal masks appear correct. Their two-forward-pass diagnostic method detected all 192 injected causal faults at exact layer granularity, found real leakage in two public open-source models, and now powers AX-RAY, VIDRAFT's structural model verification system targeting security-critical AI deployments.

What it is

VIDRAFT (비드래프트), a Korean AI deep-tech startup led by CEO Minsik Kim, released a research paper on arXiv on August 24, 2026 titled "The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models." The paper introduces a formal diagnostic framework for detecting causal leakage — a structural defect in which an autoregressive model inadvertently uses information from future token positions when computing representations for earlier positions.

The key insight the paper challenges is a widespread assumption in current AI safety auditing: that verifying the causal attention mask is sufficient to guarantee causal correctness. Modern architectures have moved well beyond pure attention. Hybrid models combine attention layers with State Space Models (SSMs), recurrent operations, convolutions, and chunked scan operations. Each of these computational pathways can introduce future-information leakage independently of whether the attention mask is set correctly.

VIDRAFT applied this diagnostic to real public models and found causal leakage in:

• NVIDIA's Nemotron-H-8B (PyTorch execution path)
• Zyphra's Zamba2-1.2B (PyTorch execution path)

Models audited without detected leakage included Bamba-9B, Falcon-H1, Granite-4.0-H, Mamba2, and RecurrentGemma.

The research findings feed directly into AX-RAY, VIDRAFT's AI safety diagnostic platform, which is being positioned as a structural verification layer for enterprise and government foundation model adoption — most immediately for a South Korean government consortium developing cybersecurity-specialized AI foundation models.

A domestic Korean patent has been filed and examination requested prior to the paper's public release.

How it works

The core diagnostic technique is deliberately lightweight and architecture-agnostic. At a conceptual level:

1. Construct two minimally differing inputs — two sequences that are identical except at the final token position.
2. Run two separate forward passes (no training, no gradient computation) through the model being audited.
3. Compare internal representations layer by layer at all positions preceding the final token.

The invariance principle is simple: in a causally correct autoregressive model, changing a future token position must not alter any earlier position's hidden state at any layer. If any earlier representation changes between the two forward passes, that layer is identified as the point of causal leakage.

This approach is notable because it requires only two inference passes and no access to training data, gradients, or model weights beyond what is needed for standard inference. It pinpoints the exact layer where causality first breaks.

On the software side, the researchers also conducted source-level code comparison against the transformers library (version 5.7.0), specifically examining chunked scan implementations. They identified a divergence in how input chunk axes and output chunk axes are handled across different implementations — and predicted, before running the model audit, the exact chunk size threshold at which leakage would begin. The predictions matched empirically: leakage in Zamba2-1.2B started at the declared chunk size of 256, and in Nemotron-H-8B at 128.

The broader implication VIDRAFT raises is architectural: causal leakage can make benchmark numbers look better, not worse. When future information bleeds into present computations during training, next-token prediction becomes artificially easier, driving down training loss and perplexity. This means a structurally defective model can appear to outperform a structurally correct one on standard leaderboard metrics — making independent causal auditing a separate and necessary verification step from capability evaluation.

AX-RAY is designed to surface exactly this class of hidden structural risk: not whether a model scores well on benchmarks, but whether the execution code and runtime behavior are causally sound and free of unintended information pathways.

Benchmarks & results

• 192 synthetic causal faults were injected across diverse defect types. Standard causal mask inspection detected 0 of 192. VIDRAFT's prefix-invariance diagnostic detected all 192, at exact layer granularity.
• Real-world leakage confirmed in Nemotron-H-8B and Zamba2-1.2B via the same method.
• No leakage detected in Bamba-9B, Falcon-H1, Granite-4.0-H, Mamba2, and RecurrentGemma under the same audit.
• Code-predicted leakage boundaries matched empirical measurements exactly for both affected models.

How to try it

The paper is publicly available on arXiv. AX-RAY itself is not yet publicly released as an open-source tool or hosted API — VIDRAFT is currently applying it within a government cybersecurity consortium context. There are no public Hugging Face repositories, GitHub links, or API endpoints announced for AX-RAY at this time. Watch VIDRAFT's official channels for future access announcements.

---

FAQ

Q: Does this mean Nemotron-H-8B and Zamba2-1.2B are unsafe to use entirely?
A: Not necessarily in all use cases, but the structural defect is real and confirmed. Causal leakage means the model's training dynamics and inference behavior do not conform to the autoregressive contract. For security-sensitive or compliance-critical deployments, this kind of structural audit matters independently of benchmark performance.

Q: Why isn't checking the attention mask enough for hybrid models?
A: Attention masks only govern the attention sub-operation. Hybrid architectures route computation through SSM layers, chunked scans, convolutions, and recurrent cells — none of which are covered by the attention causal mask. A model can pass a mask check and still leak future information through these alternative paths.

Q: Can I apply the prefix-invariance test myself to a model I'm evaluating?
A: The method requires only standard forward-pass inference — two passes with minimally differing inputs, then layer-wise comparison of hidden states. No training or gradient access is needed. The full methodology is described in the arXiv paper; a public implementation has not been separately released as of this writing.

---

Originally reported by AI타임스 (2026-08-26) — source article.