TL;DR:VIDRAFT has published a diagnostic method that detectscausal leakage— the unintended flow of future-token information into earlier positions — across attention, state-space, and hybrid autoregressive models. Applied to public models, the technique identified leakage in Nemotron-H-8B and Zamba2-1.2B while injecting 192 synthetic faults and catching every single one at layer granularity. The research is now integrated into VIDRAFT's AI safety diagnostic system, AX-RAY, and is being positioned as a verification technology for government-backed security-specialized foundation model programs.
VIDRAFT (비드래프트) is a Korean Pre-AGI AI startup focused on AI safety and diagnostics. On August 24, 2026, the team published a paper on arXiv titled "The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models", introducing a principled diagnostic framework for detecting causal leakage in autoregressive language models.
Causal leakage is the structural defect that occurs when information from future token positions illegitimately influences the internal representations of earlier positions — violating the core causality guarantee that autoregressive models depend on for correctness and trustworthy evaluation.
The core insight: traditional causal verification simply checks whether the attention causal mask is applied correctly. That's no longer sufficient. Modern architectures increasingly combine attention layers with state-space models (SSMs), recurrent operators, convolutions, and chunked scan mechanisms, each of which introduces independent execution paths where future information could silently leak through — paths that a mask-only audit would never catch.
The research findings are being commercialized and integrated into AX-RAY, VIDRAFT's AI safety diagnostics system. The company has also filed and requested examination of a domestic (Korean) patent covering the underlying technology prior to the paper's public release.
The diagnostic method is conceptually elegant and computationally lightweight:
This design means the audit is:
For hybrid models using chunked scan operations, the team also performed static code analysis of the relevant open-source library implementations to identify discrepancies in how input and output chunk axes are processed — then validated those findings empirically on real model weights. AX-RAY extends this beyond a one-off audit: it aims to systematically verify that a model's benchmark scores, execution code, and architectural structure all behave as designed — flagging abnormal causal dependencies or structural risk paths that could compromise the integrity of evaluation results.
The paper reports the following publicly disclosed findings:
transformers 5.7.0
library and identified a discrepancy in chunk-axis handling between reference and specific implementations.VIDRAFT notes that causal leakage has direct implications for evaluation integrity: if future information seeps into earlier positions during training, metrics like cross-entropy loss and perplexity (PPL) may appear artificially better than a correct implementation would produce.
The underlying paper is publicly available on arXiv (published August 24, 2026). Search for: "The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models".
As of the date of this article, AX-RAY is not publicly available as a self-serve tool — it is being deployed in the context of government-backed security-specialized foundation model validation programs in Korea. There are no public Hugging Face model cards, GitHub repositories, or OpenAI-compatible API endpoints announced for AX-RAY at this time.
Developers interested in the technology or potential access should monitor VIDRAFT's official channels for future announcements.
Q: Why isn't checking the causal mask enough for modern models?
A: The causal mask only governs attention score computation. Hybrid models contain additional execution paths — SSM recurrences, convolution kernels, and chunked scan operators — that the mask does not touch. Future tokens can leak through any of these paths without ever triggering a mask-based check.
Q: Does this diagnostic require access to model weights or training data?
A: No. The method only requires the ability to run two forward passes through the model and inspect intermediate layer activations. No gradients, no training data, and no weight modification are needed.
Originally reported by 이코노미스트 (2026-08-26) — source article.