The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State‑Space, and Hybrid Sequence Models

说明与用途

审计发现自回归模型中的隐藏因果泄漏，检测到两款公开模型的缺陷。仅需两次前向传播、无梯度的简单检查即可定位泄漏并确保模型正确性。

问题

Autoregressive models may silently leak future information, inflating metrics and compromising downstream use, yet existing audits only inspect attention masks and miss leaks in other computation paths.

结果

The audit detected all 192 injected leaks and localized them, while mask inspection missed all. Two public models (Zamba2‑1.2B and Nemotron‑H‑8B) exhibited causal leakage at their chunk boundaries.

工作流

• Generate a random token sequence x1 of length T.
• Create a perturbed sequence x2 by changing token at position T‑1.
• Attach forward hooks to all layers to capture outputs.
• Run forward pass f(x1) with caching disabled.
• Run forward pass f(x2) with caching disabled.
• For each layer ℓ compute Δℓ = max|h1ℓ[0:T‑1] – h2ℓ[0:T‑1]| (exclude perturbed position).
• Find the first layer ℓ* where Δℓ > threshold τ; if none, report CLEAN, else report LEAK at ℓ*.
• Optionally perform ε‑sweep to distinguish real leaks from numerical noise.

证据

We built a check that fits on one page, ran it on eight public checkpoints, and found real defects in two of them.

来源

Mask inspection finding nothing is not a bug in mask inspection. It is the point: the leaks were not in the masks.

来源

Two forward passes. No gradients. Runs on a CPU. Fits on a page.

来源