Auditing Causal Leakage in Sequence Models

# Illustrative sketch (not from the paper)
import torch

def audit_prefix_leakage(model, x1, x2, threshold):
    # Disable caching if the model supports it
    if hasattr(model, "use_cache"):
        model.use_cache = False

    # Dictionary to store intermediate outputs per layer
    layer_outputs = {}

    # Hook factory that records the output of a layer
    def get_hook(name):
        def hook(module, input, output):
            layer_outputs[name] = output.detach()
        return hook

    # Register forward hooks on every sub‑module (skip the top‑level container)
    hooks = []
    for name, module in model.named_modules():
        if name == "":
            continue
        hooks.append(module.register_forward_hook(get_hook(name)))

    # First forward pass with the original sequence
    _ = model(x1)
    outputs_x1 = layer_outputs.copy()

    # Clear storage before the second pass
    layer_outputs.clear()

    # Second forward pass with the modified final token
    _ = model(x2)
    outputs_x2 = layer_outputs.copy()

    # Remove all hooks to avoid side effects
    for h in hooks:
        h.remove()

    # Compare each layer's outputs (ignore the final position)
    for name in outputs_x1:
        diff = torch.abs(outputs_x1[name][..., :-1] - outputs_x2[name][..., :-1])
        max_diff = diff.max().item()
        if max_diff > threshold:
            return name, max_diff
    return None, 0.0

# Example usage (placeholders)
# model = MyModel()
# x1 = torch.tensor([...])
# x2 = x1.clone()
# x2[-1] = different_token
# layer, delta = audit_prefix_leakage(model, x1, x2, threshold=1e-5)

// Illustrative sketch (not from the paper)
const tf = require('@tensorflow/tfjs-node');

function auditPrefixLeakage(model, x1, x2, threshold) {
  // Disable caching if the model exposes such a flag
  if (model.useCache !== undefined) model.useCache = false;

  const layerOutputs = {};

  // Wrap each layer's call method to capture its output
  model.layers.forEach((layer, idx) => {
    const originalCall = layer.call.bind(layer);
    layer.call = function (inputs, ...args) {
      const out = originalCall(inputs, ...args);
      layerOutputs[`layer_${idx}`] = out.clone();
      return out;
    };
  });

  // First forward pass (original sequence)
  model.predict(x1);
  const outputsX1 = { ...layerOutputs };
  // Reset storage
  for (const k in layerOutputs) delete layerOutputs[k];

  // Second forward pass (modified final token)
  model.predict(x2);
  const outputsX2 = { ...layerOutputs };

  // Compare each captured layer output (ignore final position)
  for (const name in outputsX1) {
    const diff = tf.abs(tf.sub(
      outputsX1[name].slice([0, 0], [-1, -1]),
      outputsX2[name].slice([0, 0], [-1, -1])
    ));
    const maxDiff = diff.max().arraySync();
    if (maxDiff > threshold) {
      return { layer: name, delta: maxDiff };
    }
  }
  return { layer: null, delta: 0 };
}

// Example usage (placeholders)
// const model = await tf.loadLayersModel('path/to/model.json');
// const x1 = tf.tensor([...]);
// const x2 = x1.clone(); // modify final token as needed
// const result = auditPrefixLeakage(model, x1, x2, 1e-5);