3/5 SSMs are recurrent, each token depends on previous state. Mamba decode reads state → updates it. Misclassified request reads garbage → propagates recursively through all tokens. Attention writes K/V first, then attends. Safe even if misclassified.

→ View original post on X — @ai21labs,