How should I interpret this note on diffusion of the internal state of a PRNG? This question is about Tyche, a non-cryptographic PRNG. While the PRNG is not cryptographic the analysis and this question surely is heavily involved with cryptography, so I think it's on-topic here.

In short, Tyche is a nonlinear PRNG based on the ChaCha quarter-round function. The state (4 words $a, b, c, d$) gets mixed using the $MIX$ function (which is basically the ChaCha quarter-round), and then a part of the state gets returned. This is the $MIX$ function in pseudocode:

MIX(a, b, c, d):
    a = a + b
    d = (d ^ a) &lt;&lt;&lt; 16
    c = c + d
    b = (b ^ c) &lt;&lt;&lt; 12
    a = a + b
    d = (d ^ a) &lt;&lt;&lt; 8
    c = c + d
    b = (b ^ c) &lt;&lt;&lt; 7


Later the authors propose a faster variant (due to instruction level parallelism), where the inverse of $MIX$ is used, $\textit{MIX-i}$:

MIX-i(a, b, c, d):
    b = (b &gt;&gt;&gt;  7) ^ c; c = c - d
    d = (d &gt;&gt;&gt;  8) ^ a; a = a - b
    b = (b &gt;&gt;&gt; 12) ^ c; c = c - d
    d = (d &gt;&gt;&gt; 16) ^ a; a = a - b


Then the authors note the following (emphasis mine):


  The downside, however, is that $\textit{MIX-i}$ diffuses bits slower than $MIX$
  does: for 1-bit differences in the internal state, 1 $MIX$ call averages
  26 bit flipped bits, while $\textit{MIX-i}$ averages 8.


I don't exactly know how to interpret this note.


Why is this a downside?
Does this mean the quality of the PRNG is less?
By default the initial constant state (in $c$ and $d$) gets mixed with the seed (in $a$ and $b$) using 20 calls to $MIX$. Does it need more iterations to initialize the PRNG when using $\textit{MIX-i}$?
It surely can't affect period length since it's the inverse, right?
I see no issue here about bit diffusion; if $\textit{MIX-i}$ has a problem, so does $\textit{MIX}$.

The reason is simple, $\textit{MIX-i}$ is precisely $\textit{MIX}$, but backwards.  Hence, if $\textit{MIX}$ starting at initial state $S_0$ and ending at final state $S_n$, would generate the output:

$B_0, B_1, B_2, ..., B_{n-2}, B_{n-1}, B_n$

then $\textit{MIX-i}$, starting at initial state $S_n$, would generate the output:

$B_n, B_{n-1}, B_{n-2}, ..., B_2, B_1, B_0$

If the sequence $B_n, B_{n-1}, B_{n-2}, ..., B_2, B_1, B_0$ has a problem (either against a statistical analysis, or against a cryptographical attack), then $B_0, B_1, B_2, ..., B_{n-2}, B_{n-1}, B_n$ should have the same problem.

Now, is $\textit{MIX}$ (or $\textit{MIX-i}$) a good random number generator – either statistically, or as a cryptographically secure random number generator?  Well, I don't know if it's a good statistical rng (it does have an obvious state recovery attack that takes $O(2^{64})$ time, hence I believe it is disqualified from being considered a CSRNG); however the fact that hidden bits from $A, C, D$ are not mixed in as well as they may be are not an automatic disqualification.