Architectural Leakage: Per-Timestep Sequence Models That Quietly See the Future

Leakage in time-series evaluation is usually a data problem: a split that lets training see the test period, or a feature computed after the label. We document a form those checks cannot see, architectural leakage, in which the split and the features are clean and the model itself has a path from future inputs to past outputs. It arises whenever a per-timestep model conditions on a whole-sequence quantity—a bidirectional encoder, unmasked attention, symmetric padding, a pooled context vector—and it is invisible to split- and feature-level checks because the model is trained and scored under the same protocol. We give a model-agnostic detector, the future-perturbation score (FPS): perturb timesteps after $k$, measure the change at timesteps $\le k$; a causal model scores exactly zero. It needs only forward(x, t): a replay on the truncated prefix detects the leak, and four value perturbations of the future narrow down what is read; a shuffle-only test would pass the form in the audited model, a mean-pooled context, because a mean is permutation-invariant. We then measure what such a leak is worth: on a monotone early-warning label, an oracle $b$-bit channel carrying the onset admits a label-only score computed from the labels alone; on PhysioNet2019 a single such bit reaches $0.957$ (at least $0.979$ under a validation-selected partition), above every causal model we can train, and a bit predicted from whole-record summaries of the inputs already reaches $0.86$. An audit of matched causal/non-causal pairs from four families (LSTM/BiLSTM, causal/symmetric TCN, masked/unmasked Transformer, running/whole-sequence pooling) finds every causal member of the four at $0.76$–$0.80$ and every non-causal member beating its causal twin on all twenty splits, up to $0.974$; the gap survives per-patient scoring and the challenge utility. A routed additive model reported at $+14.2$ AUROC over its causal baseline serves as the case study: a fair comparison gives $-0.3$, and reading its measurement process causally recovers $+1.7$ AUROC on 19 of 20 splits ($+0.02$ normalised utility)—most of it without any router. The detector (under a minute per checkpoint) and the label-only scores (minutes on a CPU) are released.