VIDRAFT's causal-leakage audit catches 192 of 192 injected faults, flags Nemotron-H and Zamba2

Korean AI safety startup VIDRAFT has published a diagnostic method for detecting causal leakage in autoregressive models — the unintended flow of information from future token positions into the internal representations of earlier positions. According to a dev.to post describing the work, applying the method to public models confirmed leakage in the PyTorch execution paths of NVIDIA's Nemotron-H-8B and Zyphra's Zamba2-1.2B, while a fault-injection experiment saw the diagnostic catch all 192 deliberately planted defects at layer granularity.

The research appears in an arXiv paper titled "The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models," published August 24, 2026. The dev.to post notes the work was originally reported by the Korean outlet 이코노미스트 on August 26.

How the audit works

The paper's central claim is that checking whether a causal mask is correctly applied is no longer sufficient. Hybrid architectures mix attention with state-space layers, recurrent operators, convolutions and chunked scan mechanisms, and each of those components offers an execution path the attention mask never touches. A model can therefore pass a mask inspection while still letting future tokens influence earlier positions.

VIDRAFT's alternative is a prefix invariance check:

• Construct two inputs that differ only at the final sequence position and run each through the model.
• In a correctly implemented autoregressive model, the internal activations at earlier positions must be identical across both passes.
• Diff the activations layer by layer to find the first layer where invariance breaks.

The approach needs no gradients, no training data and no retraining, and it applies to pure attention, pure state-space and hybrid models alike. For hybrids that use chunked scans, the team also performed static code analysis of the open-source transformers 5.7.0 library and identified a discrepancy in how input and output chunk axes are handled between the reference implementation and a specific implementation, then validated the finding empirically on real model weights.

What the audit found

The paper reports two classes of results, per the dev.to summary.

In a controlled test, 192 synthetic causal faults were injected across diverse fault types. Traditional mask inspection detected none of them; the prefix invariance diagnostic detected all 192, localizing each fault to a specific layer.

On public checkpoints, leakage was confirmed in Nemotron-H-8B, beginning at chunk size 128, and in Zamba2-1.2B, where it begins at the model's declared chunk size of 256. Under the same diagnostic conditions, no leakage was detected in Bamba-9B, Falcon-H1, Granite-4.0-H, Mamba2 or RecurrentGemma.

The evaluation integrity problem

The practical consequence VIDRAFT highlights is benchmark trust. If future information seeps into earlier positions during training, metrics such as cross-entropy loss and perplexity can appear better than a correct implementation would produce. Scores earned under leakage do not translate to inference, where future tokens do not exist, which is why the company frames the work as an evaluation-integrity tool rather than a pure correctness bug report.

Availability and commercialization

The technique is being integrated into AX-RAY, VIDRAFT's AI safety diagnostics system, which the company positions as verification technology for government-backed security-specialized foundation model programs in Korea. A domestic Korean patent was filed and examination requested before the paper's public release. AX-RAY is not publicly available: as of the dev.to post there is no self-serve tool, GitHub repository, Hugging Face model card or OpenAI-compatible API endpoint, though the paper itself is on arXiv.

Why it matters

Benchmark numbers are the currency of model releases, and this work argues that some public hybrid models carry a structural defect that can quietly flatter loss and perplexity. The audit itself is cheap — two forward passes and an activation diff — so labs, evaluators and regulators can adopt it without retraining or privileged access, which is unusual for a safety diagnostic. It also reframes something practitioners tend to take for granted: verifying a causal mask verifies only one path through a modern model, not the model's causality as a whole. The caveats are real, though. Everything above rests on a single dev.to summary of the paper, and the findings have not been independently verified at the time of writing.