Information Leakage Due to Fault Propagation in XOR gates

In the concept of Automatic Test Pattern Generation (ATPG), two events are required to perform in sequence: Fault Activation and Fault Propagation.

In the case of a linear 2-input XOR gate, without loss of generality, we consider a stuck-at-0 fault at the input register a, while the input register b may take values independently. In order to activate the fault at a, one must set a = 1. The next step is to propagate the fault at the output. One may observe that setting the input b to either 0 or 1 will expose the fault at a to the output o.
In continuation of article, he says with assuming the fault to be stuck-at-0, just by observing whether the output is faulty Adversary can determine the value of a. More precisely, if the output is fault-free a = 0 and a = 1, otherwise.
In continuation of article, he says with assuming the fault to be stuck-at-0, just by observing whether the output is faulty Adversary can determine the value of a. More precisely, if the output is fault-free a = 0 and a = 1, otherwise.
I am confused at this point, when the type of fault is stuck-at-0 how the value of a is equal to 0 in the case of "fault-free"? Have I misunderstood the concept?