The mask passed. The scan leaked: an audit finds future tokens reaching back in two shipped hybrids

The defect this audit points at lives in the chunked scan, not in the mask. Hybrid stacks cut a sequence into fixed-size chunks so the state-space path can be run as a batched matrix operation instead of a step-by-step recurrence, and each chunk carries an input axis and an output axis that have to stay aligned. VIDRAFT says it read the chunked scan code in the open-source transformers 5.7.0 library, found a discrepancy in how those axes are handled between the reference implementation and specific ones, then confirmed the effect on real model weights ^[10]. A mask audit cannot see that, because the mask governs the attention path while the leak sits in a parallel execution path the mask never touches ^[11].

The thresholds are the part worth writing down. Zamba2-1.2B begins leaking at its declared chunk size of 256 ^[7]. Nemotron-H-8B begins at 128 ^[8], half as far into the sequence ^[19]. Leakage starting at the chunk boundary means a causality smoke test run on short prompts comes back clean, and the smaller the chunk, the more ordinary the workload that trips it.

What that does to a training or evaluation record is the real exposure. Prefix invariance is the property autoregressive models depend on for correctness and for evaluation anyone can trust ^[2]. If the forward pass that produced a score could see the token it was being asked to predict, the score is not measuring what the scoreboard says it measures. That is precisely the gap the company is selling into: AX-RAY is described as verifying that a model's benchmark numbers, its execution code and its declared architecture all behave as designed, and flagging abnormal causal dependencies ^[13].

The check itself is cheap. Two forward passes on inputs that differ only at the final position, then a layer-by-layer comparison of internal activations to find where causality first breaks, with no gradients and no retraining ^[3], and the same procedure applies to pure attention, pure SSM and hybrid models ^[4]. Nothing about that requires a vendor relationship. It costs less than the meeting about whether to run it.

Now the discount. All of this reaches us through one write-up on dev.to that is also positioning: the research is being commercialised into AX-RAY ^[13], VIDRAFT filed and requested examination of a Korean patent on the underlying technology before publishing ^[14], and the method is being pitched as verification for government-backed security-specialised foundation model programmes ^[15]. The headline result, 192 of 192 faults caught against a mask-inspection baseline that caught none ^[5], works out to 100 per cent against 0 per cent ^[18] on faults the same team injected, measured against a baseline the same team defined. The write-up carries no response from NVIDIA or Zyphra ^[21].

The detail that makes it harder to dismiss is the negative result. Bamba-9B, Falcon-H1, Granite-4.0-H, Mamba2 and RecurrentGemma came back clean under the same conditions ^[9], so 2 of 7 named models flagged ^[17]. An instrument that fires on everything is not an instrument. This one discriminates, which is the first thing you check before you believe what it says about the other two.