Scan chains by design, give you the ability to load each flop with whatever value you want. Then you can toggle the clock and see the result. If you were very resilient about this you may be able to gather information about the structure. Without a GDS or netlist this is all very far fetched and unlikely. I've said before, but it is far more likely to bribe a rogue designer than to introduce back doors at this level.
