The Mask Is Not the Model: Auditing Prefix Invariance in Attention, State-Space, and Hybrid Sequence Models

The field's default causality check — inspecting the attention mask — no longer covers most of the computation graph.

Hybrid stacks mix attention with scans, and a scan has no mask. So we formalized the property the mask was standing in for: prefix invariance — the representation at position t must not depend on inputs after t. Causality is a graph-level property, not a mask property.

The audit is two forward passes. Feed x and x' identical except at the last position, hook every layer, compare the prefix, report the first layer where Δ > τ. No training, no gradients, no labels. Runs on CPU in seconds.

What we found

192 injected faults across 8 checkpoints. Attention-mask inspection detected 0. Our audit localized 192/192 to the exact layer.
A static census of transformers 5.7.0 predicted, from source alone, which released models would leak. The reference modeling_mamba2.py reduces the inter-chunk recurrence over the input chunk axis; modeling_zamba2.py and modeling_nemotron_h.py reduce over the output chunk axis. One axis.
The dynamic audit confirmed the prediction exactly. Zamba2-1.2B leaks starting at sequence length 256 — its declared chunk size. Nemotron-H-8B at 128 — its declared chunk size. Every conformant implementation we checked (Bamba-9B, Falcon-H1, Granite-4.0-H, Mamba2, RecurrentGemma) came back clean.

Two norms this cost us to learn

A CLEAN verdict is uninterpretable without a positive control on the same loaded checkpoint. We hit checkpoints that returned bit-identical outputs for different inputs — Δ = 0 everywhere, which looks perfect and means nothing.
Audit length must exceed the architecture's chunk or window parameter. At our default T = 48, Zamba2 looks clean: its chunk is 256, so the buggy branch is never entered. We also re-audited two clean models at 3× their own window width, to confirm the positive findings were not an artifact of merely lengthening sequences.

On why there is no code repository. This is deliberate, and Appendix A.1 explains it. The method is five lines of arithmetic on top of standard forward hooks — reimplementable in about an hour against any model whose layers are enumerable — and an independent reimplementation is a stronger reproduction than running our binary. So we release measurements instead: complete audit logs, exact checkpoint identifiers, per-layer delta arrays for every clean scan and every injected trial, and the injected-fault specifications. Everything needed to reproduce — or contest — any number in the paper is in that set.

Scope, stated plainly: the defect lives in the PyTorch chunked-scan path (torch_forward / segment_sum) that executes when the optional fused kernels are absent. Several checkpoints could not be loaded in our environment, and we make no claim about those.

Causal leakage does not crash. It lowers training loss and perplexity — it makes the very metrics you select models with look better. That asymmetry is why we think a causal-correctness certificate belongs next to the parameter count in a model release.

Happy to discuss the threshold choice, the ε-sweep discriminator, or where else this metamorphic relation applies.