Documentation

LeanMlir.Proofs.Training.BatchSealKit

The batch-BatchNorm seal kit — non-degeneracy machinery for the full-width nets #

planning/full_width_seals.md §3. The level-2/3 witnesses (Training/JacobianSeal.lean's backward_nontrivial_of_fderiv_ne) have until now been exhibited on 2-channel per-example proxies, whose BatchNorm is bnForward over one activation. The nets the ImageNet artifacts actually run normalize with StableHLO.bnBatchLAbnBatchTensor4 at the network's left-assoc index, i.e. bnPerChannelFlat oc (N·h·w): each channel over all its batch-and-spatial cells. This file is the machinery for sealing those, shared by the four kinked full-width nets (ResNet-34/50, MobileNetV2/V4).

⭐⭐ Why the carrier has to change, and what that costs #

A proxy seal carries a channel difference: channel 0 = channel 1 + δ at every position. Under per-channel batch BN that carrier dies — a channel-uniform offset is exactly what the channel's own mean subtracts — and at N = 1 the structural net is constant in its input outright. So the carrier here is an example difference (EDiff in the per-net files): example 0's slab is example 1's slab plus δ, per channel. Batch BN keeps it and scales it by γ_c · istd_c (bnBatchLA_exdiff), because the two examples share one mean and one istd. That forces N = 2 and makes the witness exercise the one op that couples examples.

The cost is that every fact now has to be read at a cell (n, c, i, j) of a left-assoc flat index. §1 pays that once: bcell is the per-example Tensor3 view, bnRowLA is the row BN normalizes, and bnBatchLA_bcell is the bridge. Everything after it is the usual BN algebra on one row.

What is here #

noncomputable def Proofs.BatchSeal.bcell {N c h w : } (v : Vec (N * (c * h * w))) (n : Fin N) :
Tensor3 c h w

Example n's [C,H,W] slab of a batched activation Vec (N·(c·h·w)). Every per-cell statement in a batched seal is about this.

Equations
Instances For
    noncomputable def Proofs.BatchSeal.bfrom {N c h w : } (f : Fin NTensor3 c h w) :
    Vec (N * (c * h * w))

    Assemble a batched activation from per-example slabs — the inverse of bcell, used to write the witness input down.

    Equations
    Instances For
      theorem Proofs.BatchSeal.bcell_bfrom {N c h w : } (f : Fin NTensor3 c h w) (n : Fin N) :
      bcell (bfrom f) n = f n
      theorem Proofs.BatchSeal.flatten_bcell {N c h w : } (v : Vec (N * (c * h * w))) (n : Fin N) :

      The flattened slab is the Mat row — the form every per-example op consumes.

      theorem Proofs.BatchSeal.bcell_add {N c h w : } (u v : Vec (N * (c * h * w))) (n : Fin N) (ci : Fin c) (i : Fin h) (j : Fin w) :
      bcell (u + v) n ci i j = bcell u n ci i j + bcell v n ci i j
      theorem Proofs.BatchSeal.bcell_smul {N c h w : } (t : ) (v : Vec (N * (c * h * w))) (n : Fin N) (ci : Fin c) (i : Fin h) (j : Fin w) :
      bcell (t v) n ci i j = t * bcell v n ci i j
      theorem Proofs.BatchSeal.bcell_shift {N c h w : } (v : Vec (N * (c * h * w))) (s : ) (n : Fin N) (ci : Fin c) (i : Fin h) (j : Fin w) :
      bcell (fun (k : Fin (N * (c * h * w))) => v k + s) n ci i j = bcell v n ci i j + s

      Adding a batch-uniform vector shifts every example's slab the same way — the shape a zeroed residual body contributes, and the reason it is transparent to the example difference.

      theorem Proofs.BatchSeal.bcell_batchMap {N a oc h' w' : } (f : Vec aVec (oc * h' * w')) (x : Vec (N * a)) (n : Fin N) :

      batchMap acts slab by slab.

      theorem Proofs.BatchSeal.bcell_pool {N c h w : } (x : Vec (N * (c * (2 * h) * (2 * w)))) (n : Fin N) :

      The batched 3×3/s2 pool, slab by slab.

      theorem Proofs.BatchSeal.row_batchMap {N a b : } (f : Vec aVec b) (x : Vec (N * a)) (n : Fin N) :

      batchMap at a per-example output that is read as a plain Vec (the head's GAP/dense).

      noncomputable def Proofs.BatchSeal.laIdx (N oc h w : ) (n : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
      Fin (N * (oc * h * w))

      The network's left-assoc [N,C,H,W] flat index.

      Equations
      Instances For
        theorem Proofs.BatchSeal.bcell_eq_laIdx {N oc h w : } (v : Vec (N * (oc * h * w))) (n : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
        bcell v n c i j = v (laIdx N oc h w n c i j)
        theorem Proofs.BatchSeal.laIdx_cast (N oc h w : ) (n : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :

        The one arithmetic fact: ((c,i),j) and (c,(i,j)) are the same offset, so the mul_assoc cast that defines bnBatchLA sends the network cell to the bnBatchTensor4 cell. finProdFinEquiv is row-major, so both sides are j + w·i + h·w·c + oc·h·w·n.

        noncomputable def Proofs.BatchSeal.bnRowLA (N oc h w : ) (v : Vec (N * (oc * h * w))) (c : Fin oc) :
        Vec (N * (h * w))

        The row batch BN normalizes: channel c's N·h·w cells, over the whole batch.

        Equations
        Instances For
          theorem Proofs.BatchSeal.bnRowLA_apply {N oc h w : } (v : Vec (N * (oc * h * w))) (c : Fin oc) (n : Fin N) (i : Fin h) (j : Fin w) :
          bnRowLA N oc h w v c (finProdFinEquiv (n, finProdFinEquiv (i, j))) = bcell v n c i j

          The row, read at (n, (i, j)), is the cell (n, c, i, j).

          theorem Proofs.BatchSeal.bnBatchLA_bcell (N oc h w : ) (ε : ) (γ β : Vec oc) (v : Vec (N * (oc * h * w))) (n : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
          bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n c i j = bnForward (N * (h * w)) ε (γ c) (β c) (bnRowLA N oc h w v c) (finProdFinEquiv (n, finProdFinEquiv (i, j)))

          ⭐⭐ The bridge: a cell of a bnBatchLA output is the scalar bnForward of that cell's channel row, at that cell's position in the row. Everything else in this file is BN algebra on one row.

          theorem Proofs.BatchSeal.bnBatchLA_pointwise {N oc h w : } (ε : ) (γ β : Vec oc) (v : Vec (N * (oc * h * w))) (P : Prop) (hP : ∀ (c : Fin oc) (q : Fin (N * (h * w))), P (bnForward (N * (h * w)) ε (γ c) (β c) (bnRowLA N oc h w v c) q)) (k : Fin (N * (oc * h * w))) :
          P (StableHLO.bnBatchLA N oc h w ε γ β v k)

          The workhorse. A property of every cell of a bnBatchLA output, reduced to the scalar bnForward on each channel's row — no index decomposition at the call site. Every clause of the shape "this BN output is off the kink / inside a window" goes through here.

          theorem Proofs.BatchSeal.bnForward_chan_diff_γ {n : } (ε γ β : ) (z : Vec n) (k₀ k₁ : Fin n) :
          bnForward n ε γ β z k₀ - bnForward n ε γ β z k₁ = γ * (z k₀ - z k₁) * bnIstd n z ε

          BN acts on coordinate differences by γ·istd — the exact identity that propagates the carrier undamped through every BN, and the reason no BN-variance derivative is ever taken: the difference is γ · (difference) · istd with istd evaluated at the same activation.

          theorem Proofs.BatchSeal.bnForward_abs_sub_le {n : } (ε γ β : ) ( : 0 < ε) (v : Vec n) (k : Fin n) :
          |bnForward n ε γ β v k - β| |γ| * n

          The two-sided BN margin |bn − β| ≤ |γ|·√n, with no mean/variance computation (bnXhat_sq_le). bnForward_lb's symmetric form; what makes a large β keep a relu off its kink at every input, so the structural net needs no eventually-argument for its relus.

          theorem Proofs.BatchSeal.sqrt_lt_param (n : ) (β : ) ( : 0 β) (h : n < β ^ 2) :
          n < β

          √n < β from n < β² — the margin check at each of the witness's BN widths.

          theorem Proofs.BatchSeal.bnRowLA_const {N oc h w : } (c₀ : ) (ci : Fin oc) :
          bnRowLA N oc h w (fun (x : Fin (N * (oc * h * w))) => c₀) ci = fun (x : Fin (N * (h * w))) => c₀

          A constant activation has a constant row.

          theorem Proofs.BatchSeal.bnBatchLA_const {N oc h w : } (hn : 0 < N * (h * w)) (ε : ) (γ β : Vec oc) (b c₀ : ) ( : ∀ (ci : Fin oc), β ci = b) (k : Fin (N * (oc * h * w))) :
          StableHLO.bnBatchLA N oc h w ε γ β (fun (x : Fin (N * (oc * h * w))) => c₀) k = b

          A constant channel normalizes to β (variance 0, xhat = 0): a zeroed residual body is the constant β₂, whatever γ₂ is. The batched peer of bnForward_const.

          theorem Proofs.BatchSeal.bnBatchLA_abs_sub_le {N oc h w : } (ε : ) ( : 0 < ε) (γ β : Vec oc) (g b : ) ( : ∀ (ci : Fin oc), γ ci = g) ( : ∀ (ci : Fin oc), β ci = b) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          |StableHLO.bnBatchLA N oc h w ε γ β v k - b| |g| * ↑(N * (h * w))

          The batched margin: with γ, β channel-constant, every cell is within |g|√(N·h·w) of b.

          theorem Proofs.BatchSeal.bnBatchLA_pos {N oc h w : } (ε : ) ( : 0 < ε) (γ β : Vec oc) (g b : ) ( : ∀ (ci : Fin oc), γ ci = g) ( : ∀ (ci : Fin oc), β ci = b) (hm : |g| * ↑(N * (h * w)) < b) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          0 < StableHLO.bnBatchLA N oc h w ε γ β v k

          Positivity from the margin|g|√(N·h·w) < b makes the whole BN output strictly positive, at every input. The relu clause of every conv-bn-relu stage in the witness.

          theorem Proofs.BatchSeal.bnBatchLA_window {N oc h w : } (ε : ) ( : 0 < ε) (γ β : Vec oc) (g b : ) ( : ∀ (ci : Fin oc), γ ci = g) ( : ∀ (ci : Fin oc), β ci = b) (hlo : |g| * ↑(N * (h * w)) < b) (hhi : b + |g| * ↑(N * (h * w)) < 6) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          0 < StableHLO.bnBatchLA N oc h w ε γ β v k StableHLO.bnBatchLA N oc h w ε γ β v k < 6

          The relu6 window from the margin — the two-sided twin of bnBatchLA_pos. With β = b strictly inside (|g|√(N·h·w), 6 − |g|√(N·h·w)) the whole BN output sits strictly inside (0, 6), at every input, so relu6_id_window collapses the stage that follows it. ⭐ b = 3 centres the window and makes both hypotheses the single check |g|√(N·h·w) < 3.

          theorem Proofs.BatchSeal.bnBatchLA_smooth6 {N oc h w : } (ε : ) ( : 0 < ε) (γ β : Vec oc) (g b : ) ( : ∀ (ci : Fin oc), γ ci = g) ( : ∀ (ci : Fin oc), β ci = b) (hlo : |g| * ↑(N * (h * w)) < b) (hhi : b + |g| * ↑(N * (h * w)) < 6) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          StableHLO.bnBatchLA N oc h w ε γ β v k 0 StableHLO.bnBatchLA N oc h w ε γ β v k 6

          ⭐⭐ Both relu6 clauses at once, in the ≠ 0 ∧ ≠ 6 shape every MobileNet smoothness bundle is stated in. Since the bound is input-independent, this discharges a relu6 clause without reading the activation — which is why a relu6 net's whole clause bundle is weight-only.

          theorem Proofs.BatchSeal.bnBatchLA_exdiff {N oc h w : } (ε : ) (γ β : Vec oc) (v : Vec (N * (oc * h * w))) (n₀ n₁ : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
          bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n₀ c i j - bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n₁ c i j = γ c * (bcell v n₀ c i j - bcell v n₁ c i j) * bnIstd (N * (h * w)) (bnRowLA N oc h w v c) ε

          ⭐⭐ The carrier step. Two examples of one channel share the channel's mean and istd, so batch BN keeps their difference and multiplies it by γ_c · istd_c. This is what a channel-difference carrier cannot do under per-channel batch BN, and it is why the witness is at N = 2.

          theorem Proofs.BatchSeal.bnBatchLA_cell_inj {N oc h w : } (ε : ) ( : 0 < ε) (γ β : Vec oc) (v : Vec (N * (oc * h * w))) (n : Fin N) (c : Fin oc) ( : γ c 0) (i j : Fin h) (i' j' : Fin w) (heq : bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n c i i' = bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n c j j') :
          bcell v n c i i' = bcell v n c j j'

          Batch BN is injective within one example and channel (γ_c ≠ 0): it is the strictly monotone affine map γ_c·istd_c·(· − μ_c) + β_c there. The stem pool's no-tie discharge — equal pooled cells force equal pre-BN cells, and the witness's ramp is positionally injective.

          noncomputable def Proofs.BatchSeal.ctK (oc ic kH kW : ) (s : ) :
          Kernel4 oc ic kH kW

          The centre-tap broadcast kernel. Every output channel reads input channel 0 through the kernel's centre tap, scaled by s; every other tap is zero.

          ⚠ Only the centre tap, and that is the point: conv2d pads with zeros, so a conv of a constant is not constant near the border — but the centre tap kh = (kH−1)/2 reads position hi itself, which is in range at every output cell. So this kernel is transparent to a uniform offset at every position, which a multi-tap kernel is not.

          Equations
          Instances For
            theorem Proofs.BatchSeal.conv2d_ctK {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (x : Tensor3 ic h w) (o : Fin oc) (hi : Fin h) (wi : Fin w) :
            conv2d (ctK oc ic kH kW s) b x o hi wi = b o + s * x c₀ hi wi

            The centre-tap conv value: b o + s · (input channel 0 at the same position), at every output channel. ⚠ c₀ is passed in (rather than built from 0 < ic) so that the carrier's channel index is the same term at every use site — ring needs those istds to be one atom.

            theorem Proofs.BatchSeal.flatConv_ctK {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (v : Vec (ic * h * w)) (o : Fin oc) (hi : Fin h) (wi : Fin w) :
            Tensor3.unflatten (flatConv (ctK oc ic kH kW s) b v) o hi wi = b o + s * Tensor3.unflatten v c₀ hi wi

            The flat centre-tap conv, in cell coordinates.

            theorem Proofs.BatchSeal.decimate_unflatten (oc h w : ) (z : Vec (oc * (2 * h) * (2 * w))) (c : Fin oc) (hi : Fin h) (wi : Fin w) :
            Tensor3.unflatten (decimateFlat oc h w z) c hi wi = Tensor3.unflatten z c 2 * hi, 2 * wi,

            Decimation reads position (2i, 2j), channel for channel (the generic peer of the retired 2-channel decimate_unflatten).

            theorem Proofs.BatchSeal.flatConvStride2_ctK {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (v : Vec (ic * (2 * h) * (2 * w))) (o : Fin oc) (hi : Fin h) (wi : Fin w) :
            Tensor3.unflatten (flatConvStride2 (ctK oc ic kH kW s) b v) o hi wi = b o + s * Tensor3.unflatten v c₀ 2 * hi, 2 * wi,

            The strided centre-tap conv: b o + s · (input channel 0 at the even position).

            theorem Proofs.BatchSeal.bcell_conv_ctK {N ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (x : Vec (N * (ic * h * w))) (n : Fin N) (o : Fin oc) (i : Fin h) (j : Fin w) :
            bcell (StableHLO.batchMap N (flatConv (ctK oc ic kH kW s) b) x) n o i j = b o + s * bcell x n c₀ i j

            The batched centre-tap conv, in cell coordinates — the carrier's conv step at stride 1 (ResNet-50's stage-1 projection is the one site that needs it).

            theorem Proofs.BatchSeal.bcell_convS2_ctK {N ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (x : Vec (N * (ic * (2 * h) * (2 * w)))) (n : Fin N) (o : Fin oc) (i : Fin h) (j : Fin w) :
            bcell (StableHLO.batchMap N (flatConvStride2 (ctK oc ic kH kW s) b) x) n o i j = b o + s * bcell x n c₀ 2 * i, 2 * j,

            The batched strided centre-tap conv, in cell coordinates — the carrier's conv step.

            theorem Proofs.BatchSeal.batchMap_flatConv_zero {N ic oc h w kH kW : } (W : Kernel4 oc ic kH kW) (b : Vec oc) (hW : ∀ (o : Fin oc) (c : Fin ic) (kh : Fin kH) (kw : Fin kW), W o c kh kw = 0) (hb : ∀ (o : Fin oc), b o = 0) (x : Vec (N * (ic * h * w))) :
            StableHLO.batchMap N (flatConv W b) x = fun (x : Fin (N * (oc * h * w))) => 0

            A zeroed conv (zero kernel, zero bias) sends everything to the constant 0 — the residual bodies. flatConv_eq_zero lifted across the batch.

            theorem Proofs.BatchSeal.batchMap_flatConvStride2_zero {N ic oc h w kH kW : } (W : Kernel4 oc ic kH kW) (b : Vec oc) (hW : ∀ (o : Fin oc) (c : Fin ic) (kh : Fin kH) (kw : Fin kW), W o c kh kw = 0) (hb : ∀ (o : Fin oc), b o = 0) (x : Vec (N * (ic * (2 * h) * (2 * w)))) :
            StableHLO.batchMap N (flatConvStride2 W b) x = fun (x : Fin (N * (oc * h * w))) => 0

            A zeroed STRIDED conv sends everything to the constant 0 (decimation of a constant).

            theorem Proofs.BatchSeal.decimateOdd_unflatten (oc h w : ) (z : Vec (oc * (2 * h) * (2 * w))) (c : Fin oc) (hi : Fin h) (wi : Fin w) :
            Tensor3.unflatten (decimateOddFlat oc h w z) c hi wi = Tensor3.unflatten z c 2 * hi + 1, 2 * wi + 1,

            Odd decimation reads position (2i+1, 2j+1), channel for channel — the peer of decimate_unflatten.

            theorem Proofs.BatchSeal.flatConvStride2Xla_ctK {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (v : Vec (ic * (2 * h) * (2 * w))) (o : Fin oc) (hi : Fin h) (wi : Fin w) :
            Tensor3.unflatten (flatConvStride2Xla (ctK oc ic kH kW s) b v) o hi wi = b o + s * Tensor3.unflatten v c₀ 2 * hi + 1, 2 * wi + 1,

            The strided XLA-SAME centre-tap conv: b o + s · (input channel 0 at the ODD position). flatConvStride2Xla is decimateOddFlat ∘ flatConv, so this is flatConvStride2_ctK with decimateOdd_unflatten in place of decimate_unflatten.

            theorem Proofs.BatchSeal.bcell_convS2Xla_ctK {N ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (x : Vec (N * (ic * (2 * h) * (2 * w)))) (n : Fin N) (o : Fin oc) (i : Fin h) (j : Fin w) :
            bcell (StableHLO.batchMap N (flatConvStride2Xla (ctK oc ic kH kW s) b) x) n o i j = b o + s * bcell x n c₀ 2 * i + 1, 2 * j + 1,

            The batched strided XLA-SAME centre-tap conv, in cell coordinates — MobileNetV2's stem.

            noncomputable def Proofs.BatchSeal.ctDW (c kH kW : ) (s : ) :

            The centre-tap depthwise kernel: every channel reads itself through the kernel's centre tap, scaled by s. At s = 1, b = 0 it is the identity. The depthwise peer of ctK.

            Equations
            Instances For
              theorem Proofs.BatchSeal.depthwise2d_ctDW {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (x : Tensor3 c h w) (ch : Fin c) (hi : Fin h) (wi : Fin w) :
              depthwiseConv2d (ctDW c kH kW s) b x ch hi wi = b ch + s * x ch hi wi

              The centre-tap depthwise value: b ch + s · (the same channel at the same position).

              theorem Proofs.BatchSeal.depthwiseFlat_ctDW {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (v : Vec (c * h * w)) (ch : Fin c) (hi : Fin h) (wi : Fin w) :
              Tensor3.unflatten (depthwiseFlat (ctDW c kH kW s) b v) ch hi wi = b ch + s * Tensor3.unflatten v ch hi wi

              The flat centre-tap depthwise, in cell coordinates.

              theorem Proofs.BatchSeal.bcell_dw_ctDW {N c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (x : Vec (N * (c * h * w))) (n : Fin N) (ch : Fin c) (i : Fin h) (j : Fin w) :
              bcell (StableHLO.batchMap N (depthwiseFlat (ctDW c kH kW s) b) x) n ch i j = b ch + s * bcell x n ch i j

              The batched centre-tap depthwise — the carrier's depthwise step at stride 1.

              theorem Proofs.BatchSeal.depthwiseStride2FlatXla_ctDW {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (v : Vec (c * (2 * h) * (2 * w))) (ch : Fin c) (hi : Fin h) (wi : Fin w) :
              Tensor3.unflatten (depthwiseStride2FlatXla (ctDW c kH kW s) b v) ch hi wi = b ch + s * Tensor3.unflatten v ch 2 * hi + 1, 2 * wi + 1,

              The strided XLA-SAME centre-tap depthwise, at the odd position.

              theorem Proofs.BatchSeal.bcell_dwS2Xla_ctDW {N c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (x : Vec (N * (c * (2 * h) * (2 * w)))) (n : Fin N) (ch : Fin c) (i : Fin h) (j : Fin w) :
              bcell (StableHLO.batchMap N (depthwiseStride2FlatXla (ctDW c kH kW s) b) x) n ch i j = b ch + s * bcell x n ch 2 * i + 1, 2 * j + 1,

              The batched strided XLA-SAME centre-tap depthwise — MobileNetV2's four downsampling blocks.

              theorem Proofs.BatchSeal.batchMap_depthwiseFlat_zero {N c h w kH kW : } (W : DepthwiseKernel c kH kW) (b : Vec c) (hW : ∀ (ch : Fin c) (kh : Fin kH) (kw : Fin kW), W ch kh kw = 0) (hb : ∀ (ch : Fin c), b ch = 0) (x : Vec (N * (c * h * w))) :
              StableHLO.batchMap N (depthwiseFlat W b) x = fun (x : Fin (N * (c * h * w))) => 0

              A zeroed depthwise (zero kernel, zero bias) sends everything to the constant 0 — the residual bodies of an inverted-residual net. ⛔ No strided peer is needed: a net's strided blocks change channels, so they are on the carrier and never carry a zeroed kernel.

              theorem Proofs.BatchSeal.forall_flat_of_cell {N c h w : } {v : Vec (N * (c * h * w))} {P : Prop} (hc : ∀ (n : Fin N) (ci : Fin c) (i : Fin h) (j : Fin w), P (bcell v n ci i j)) (k : Fin (N * (c * h * w))) :
              P (v k)

              Cellwise ⇒ flatwise. A property of every cell (n, c, i, j) holds at every flat index — the bridge from the bcell view back to the ∀ k shape every clause is stated in.

              theorem Proofs.BatchSeal.maxPool3s2_shift {c h w : } (x y : Tensor3 c (2 * h) (2 * w)) (δ : ) (ci : Fin c) (hxy : ∀ (r : Fin (2 * h)) (s : Fin (2 * w)), x ci r s = y ci r s + δ) (hi : Fin h) (wi : Fin w) :
              maxPool3s2 x ci hi wi = maxPool3s2 y ci hi wi + δ

              The 3×3/s2 pool shifts with a uniform offset. If one slab's channel is another's plus the constant δ, so are their pooled values — max of a uniformly shifted family (Finset.apply_sup'_eq_sup'_comp at (· + δ)). No argmax or eventually-argument: this holds at every point of the ray, which is what lets the carrier cross the only real kink in the net.

              theorem Proofs.BatchSeal.maxPool3s2_nonneg {c h w : } (x : Tensor3 c (2 * h) (2 * w)) (hx : ∀ (ci : Fin c) (r : Fin (2 * h)) (s : Fin (2 * w)), 0 x ci r s) (ci : Fin c) (hi : Fin h) (wi : Fin w) :
              0 maxPool3s2 x ci hi wi

              The pool keeps a nonnegative slab nonnegative (it selects a window cell).

              theorem Proofs.BatchSeal.globalAvgPool_shift {c h w : } (hh : 0 < h) (hw : 0 < w) (x y : Tensor3 c h w) (δ : ) (ci : Fin c) (hxy : ∀ (i : Fin h) (j : Fin w), x ci i j = y ci i j + δ) :

              GAP of a uniformly shifted channel is shifted by the same constant.

              relu is continuous everywhere — it is max · 0; only its derivative has a kink.

              A residual branch is continuous when its body is.

              theorem Proofs.BatchSeal.residualProj_continuous {m n : } (P F : Vec mVec n) (hP : Continuous P) (hF : Continuous F) :

              A projected residual is continuous when both branches are.

              theorem Proofs.BatchSeal.bnIstd_cont {n : } (ε : ) ( : 0 < ε) (k : Fin n) :
              Continuous fun (v : Vec n) => bnIstd n v ε

              bnIstd is continuous in the activation (ε > 0).

              theorem Proofs.BatchSeal.bnRowLA_continuous (N oc h w : ) (c : Fin oc) :
              Continuous fun (v : Vec (N * (oc * h * w))) => bnRowLA N oc h w v c

              bnRowLA is continuous in the activation — it is a reindex.

              maxPool3s2Flat is continuous (a sup' of coordinates).

              batchMap of a continuous per-example op is continuous.

              noncomputable def Proofs.BatchSeal.kv (c : ) (x : ) :
              Vec c

              A channel-constant BN parameter. Every structural witness's γ and β are one of these, which is what lets bnBatchLA_pointwise's property be channel-independent.

              Equations
              Instances For
                @[simp]
                theorem Proofs.BatchSeal.kv_apply (c : ) (x : ) (i : Fin c) :
                kv c x i = x
                noncomputable def Proofs.BatchSeal.zk (oc ic kH kW : ) :
                Kernel4 oc ic kH kW

                The zero kernel — every residual body.

                Equations
                Instances For
                  @[simp]
                  theorem Proofs.BatchSeal.zk_apply (oc ic kH kW : ) (o : Fin oc) (c : Fin ic) (kh : Fin kH) (kw : Fin kW) :
                  zk oc ic kH kW o c kh kw = 0
                  noncomputable def Proofs.BatchSeal.dzk (c kH kW : ) :

                  The zero depthwise kernel — an inverted-residual net's zeroed bodies.

                  Equations
                  Instances For
                    @[simp]
                    theorem Proofs.BatchSeal.dzk_apply (c kH kW : ) (ch : Fin c) (kh : Fin kH) (kw : Fin kW) :
                    dzk c kH kW ch kh kw = 0
                    theorem Proofs.BatchSeal.margin160 (n : ) (h : n < 25600) :
                    |1| * n < 160

                    1 · √n < 160 whenever n < 25600 — the margin bnBatchLA_pos consumes, at γ = 1, β = 160. Every BN width of a 224×224 ResNet witness clears it (the widest is the stem's 2·112² = 25088).

                    theorem Proofs.BatchSeal.margin192 (n : ) (h : n < 36864) :
                    |1 / 64| * n < 3

                    |1/64|·√n < 3 whenever n < 36864 = (3·64)² — the relu6 margin bnBatchLA_smooth6 consumes, at γ = 1/64, β = 3. It clears both of that lemma's hypotheses at once, β = 3 being the centre of (0, 6). Every relu6 BN width of a 224×224 MobileNetV2 witness fits: the widest is 2·112² = 25088, shared by the stem, b1's depthwise and b2's expand.

                    noncomputable def Proofs.BatchSeal.rayRamp (H W : ) :
                    Tensor3 3 H W

                    The base slab: channel 0 carries the strictly decreasing ramp −(i·W + j) — positionally injective, which is a stem pool's no-tie condition — and the other two channels are zero (a centre-tap stem reads only channel 0). Both examples carry the same slab, so the carrier vanishes at t = 0.

                    Equations
                    Instances For
                      noncomputable def Proofs.BatchSeal.rayBase (H W : ) :
                      Vec (2 * (3 * H * W))
                      Equations
                      Instances For
                        noncomputable def Proofs.BatchSeal.rayV (H W : ) :
                        Vec (2 * (3 * H * W))

                        The perturbation: all of example 0's channel 0. Uniform over the spatial grid, so it survives a max-pool for every t (maxPool3s2_shift) with no argmax argument.

                        Equations
                        Instances For
                          noncomputable def Proofs.BatchSeal.rayX (H W : ) (t : ) :
                          Vec (2 * (3 * H * W))

                          The witness input, as a ray through the base.

                          Equations
                          Instances For
                            theorem Proofs.BatchSeal.bcell_rayX (H W : ) (t : ) (n : Fin 2) (ci : Fin 3) (i : Fin H) (j : Fin W) :
                            bcell (rayX H W t) n ci i j = (if ci = 0 then -(i * W + j) else 0) + t * if n = 0 ci = 0 then 1 else 0
                            theorem Proofs.BatchSeal.rayX_zero_add (H W : ) (t : ) :
                            rayX H W 0 + t rayV H W = rayX H W t

                            The ray is continuous in its parameter.

                            def Proofs.BatchSeal.EDiff {c h w : } (δ : Fin c) (v : Vec (2 * (c * h * w))) :

                            ⭐⭐ The carrier: example 0's slab is example 1's plus the per-channel constant δ. The replacement for a channel difference, which per-channel batch BN annihilates.

                            δ is a FUNCTION of the channel, not one scalar, and that is what makes it cheap: BN multiplies channel c's offset by γ_c · istd_c with no need to prove the channels share an istd, a centre-tap conv collapses the whole function to fun _ => s · δ 0, and only δ 0 is ever read (by the head, and at each channel-changing conv).

                            Equations
                            Instances For
                              theorem Proofs.BatchSeal.EDiff_rayX (H W : ) (t : ) :
                              EDiff (fun (ci : Fin 3) => if ci = 0 then t else 0) (rayX H W t)

                              The ray's carrier: t in channel 0, nothing elsewhere.

                              theorem Proofs.BatchSeal.EDiff_shift {c h w : } (δ : Fin c) (v : Vec (2 * (c * h * w))) (s : ) (hv : EDiff δ v) :
                              EDiff δ fun (k : Fin (2 * (c * h * w))) => v k + s

                              A batch-uniform shift (a zeroed residual body) is transparent to the carrier.

                              theorem Proofs.BatchSeal.EDiff_bn (oc h w : ) (ε : ) (γ β : Vec oc) (δ δ' : Fin oc) (v : Vec (2 * (oc * h * w))) (hv : EDiff δ v) ( : ∀ (ci : Fin oc), δ' ci = γ ci * δ ci * bnIstd (2 * (h * w)) (bnRowLA 2 oc h w v ci) ε) :
                              EDiff δ' (StableHLO.bnBatchLA 2 oc h w ε γ β v)

                              ⭐⭐ Batch BN scales the carrier by γ_c · istd_c — the two examples share the channel's mean and istd, so centring keeps their difference (bnBatchLA_exdiff).

                              theorem Proofs.BatchSeal.EDiff_conv {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (δ : Fin ic) (δ' : Fin oc) (v : Vec (2 * (ic * h * w))) (hv : EDiff δ v) ( : ∀ (o : Fin oc), δ' o = s * δ c₀) :
                              EDiff δ' (StableHLO.batchMap 2 (flatConv (ctK oc ic kH kW s) b) v)

                              A centre-tap conv copies channel 0's offset to every output channel, and is transparent to the zero padding because only the centre tap is nonzero.

                              theorem Proofs.BatchSeal.EDiff_convS2 {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (δ : Fin ic) (δ' : Fin oc) (v : Vec (2 * (ic * (2 * h) * (2 * w)))) (hv : EDiff δ v) ( : ∀ (o : Fin oc), δ' o = s * δ c₀) :
                              EDiff δ' (StableHLO.batchMap 2 (flatConvStride2 (ctK oc ic kH kW s) b) v)

                              The strided peer of EDiff_conv.

                              theorem Proofs.BatchSeal.EDiff_convS2Xla {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (δ : Fin ic) (δ' : Fin oc) (v : Vec (2 * (ic * (2 * h) * (2 * w)))) (hv : EDiff δ v) ( : ∀ (o : Fin oc), δ' o = s * δ c₀) :
                              EDiff δ' (StableHLO.batchMap 2 (flatConvStride2Xla (ctK oc ic kH kW s) b) v)

                              The XLA-SAME strided peer of EDiff_conv — MobileNetV2's stem.

                              theorem Proofs.BatchSeal.EDiff_dw {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (δ δ' : Fin c) (v : Vec (2 * (c * h * w))) (hv : EDiff δ v) ( : ∀ (ch : Fin c), δ' ch = s * δ ch) :
                              EDiff δ' (StableHLO.batchMap 2 (depthwiseFlat (ctDW c kH kW s) b) v)

                              A centre-tap depthwise scales the carrier channel by channel. Unlike EDiff_conv, which collapses δ to the single value s * δ c₀ at every output channel, a depthwise reads only its own channel, so the whole function δ survives, scaled.

                              theorem Proofs.BatchSeal.EDiff_dwS2Xla {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (δ δ' : Fin c) (v : Vec (2 * (c * (2 * h) * (2 * w)))) (hv : EDiff δ v) ( : ∀ (ch : Fin c), δ' ch = s * δ ch) :

                              The strided XLA-SAME peer of EDiff_dw. The carrier is spatially uniform, so decimation — whichever phase it keeps — is transparent to it.

                              theorem Proofs.BatchSeal.EDiff_pool (c h w : ) (δ : Fin c) (v : Vec (2 * (c * (2 * h) * (2 * w)))) (hv : EDiff δ v) :

                              The 3×3/s2 pool keeps the carrier, at every t.

                              theorem Proofs.BatchSeal.divmod_inj {W a b a' b' : } (hb : b < W) (hb' : b' < W) (h : W * a + b = W * a' + b') :
                              a = a' b = b'

                              W·a + b determines a and b when b < W (division with remainder).

                              noncomputable def Proofs.BatchSeal.ctConv (oc kH kW h w : ) (t : ) :
                              Vec (2 * (oc * (2 * h) * (2 * w)))

                              The witness's strided centre-tap stem conv — the pre-BN activation on the carrier's path.

                              Equations
                              • One or more equations did not get rendered due to their size.
                              Instances For
                                theorem Proofs.BatchSeal.ctConv_bn_pos (oc kH kW h w : ) (hm : |1| * ↑(2 * (2 * h * (2 * w))) < 160) (t : ) (k : Fin (2 * (oc * (2 * h) * (2 * w)))) :
                                0 < StableHLO.bnBatchLA 2 oc (2 * h) (2 * w) 1 (kv oc 1) (kv oc 160) (ctConv oc kH kW h w t) k

                                The stem BN is strictly positive at every point of the ray (the β = 160 margin).

                                theorem Proofs.BatchSeal.ctConv_inj (oc kH kW h w : ) (hkH : 0 < kH) (hkW : 0 < kW) (t : ) (n : Fin 2) (o : Fin oc) (r r' : Fin (2 * h)) (s s' : Fin (2 * w)) (heq : bcell (ctConv oc kH kW h w t) n o r s = bcell (ctConv oc kH kW h w t) n o r' s') :
                                r = r' s = s'

                                The pre-BN stem activation is positionally injective within each example and channel: the centre tap decimates the ramp, and example 0's uniform +t shifts every position alike.

                                theorem Proofs.BatchSeal.ctConv_pool_smooth (oc kH kW h w : ) (hkH : 0 < kH) (hkW : 0 < kW) (t : ) (n : Fin 2) :
                                MaxPool3s2Smooth (bcell (StableHLO.bnBatchLA 2 oc (2 * h) (2 * w) 1 (kv oc 1) (kv oc 160) (ctConv oc kH kW h w t)) n)

                                The stem pool has no tie at the witness: BN is injective within a channel (bnBatchLA_cell_inj) and the pre-BN activation is positionally injective. Stated in the ∀ example, MaxPool3s2Smooth (slab) shape the nets' *PoolSmoothAt unfolds to.

                                theorem Proofs.BatchSeal.head_diff_ct {c h w nCls : } (hh : 0 < h) (hw : 0 < w) (c₀ : Fin c) (hc₀ : c₀ = 0) (j : Fin nCls) (Wd : Mat c nCls) (bd : Vec nCls) (hWd : ∀ (ci : Fin c), Wd ci j = if ci = 0 then 1 else 0) (hbd : bd j = 0) (v : Vec (2 * (c * h * w))) (δ : Fin c) (hv : EDiff δ v) :

                                GAP and the dense head deliver the carrier to one class: GAP of a uniformly shifted channel is shifted by the same constant, and a Wd that reads channel c₀ into class j turns the per-channel carrier into δ c₀. Stated on the batchMaps a *HeadB unfolds to, so every net's head instantiates it.

                                theorem Proofs.BatchSeal.depthwiseStride2Flat_ctDW {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (v : Vec (c * (2 * h) * (2 * w))) (ch : Fin c) (hi : Fin h) (wi : Fin w) :
                                Tensor3.unflatten (depthwiseStride2Flat (ctDW c kH kW s) b v) ch hi wi = b ch + s * Tensor3.unflatten v ch 2 * hi, 2 * wi,
                                theorem Proofs.BatchSeal.bcell_dwS2_ctDW {N c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (x : Vec (N * (c * (2 * h) * (2 * w)))) (n : Fin N) (ch : Fin c) (i : Fin h) (j : Fin w) :
                                bcell (StableHLO.batchMap N (depthwiseStride2Flat (ctDW c kH kW s) b) x) n ch i j = b ch + s * bcell x n ch 2 * i, 2 * j,
                                theorem Proofs.BatchSeal.EDiff_dwS2 {c h w kH kW : } (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec c) (δ δ' : Fin c) (v : Vec (2 * (c * (2 * h) * (2 * w)))) (hv : EDiff δ v) ( : ∀ (ch : Fin c), δ' ch = s * δ ch) :
                                def Proofs.BatchSeal.BUnif {c h w : } (a : Fin 2Fin c) (v : Vec (2 * (c * h * w))) :
                                Equations
                                Instances For
                                  theorem Proofs.BatchSeal.EDiff_of_BUnif {c h w : } (a : Fin 2Fin c) (δ : Fin c) (v : Vec (2 * (c * h * w))) (hv : BUnif a v) ( : ∀ (ci : Fin c), δ ci = a 0 ci - a 1 ci) :
                                  EDiff δ v
                                  theorem Proofs.BatchSeal.BUnif_convS2Xla {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (a : Fin 2Fin ic) (a' : Fin 2Fin oc) (v : Vec (2 * (ic * (2 * h) * (2 * w)))) (hv : BUnif a v) (ha : ∀ (n : Fin 2) (o : Fin oc), a' n o = b o + s * a n c₀) :
                                  BUnif a' (StableHLO.batchMap 2 (flatConvStride2Xla (ctK oc ic kH kW s) b) v)
                                  theorem Proofs.BatchSeal.BUnif_convS2 {ic oc h w kH kW : } (c₀ : Fin ic) (hc₀ : c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ) (b : Vec oc) (a : Fin 2Fin ic) (a' : Fin 2Fin oc) (v : Vec (2 * (ic * (2 * h) * (2 * w)))) (hv : BUnif a v) (ha : ∀ (n : Fin 2) (o : Fin oc), a' n o = b o + s * a n c₀) :
                                  BUnif a' (StableHLO.batchMap 2 (flatConvStride2 (ctK oc ic kH kW s) b) v)
                                  theorem Proofs.BatchSeal.BUnif_map {c h w : } (f : ) (a a' : Fin 2Fin c) (v : Vec (2 * (c * h * w))) (hv : BUnif a v) (ha : ∀ (n : Fin 2) (ci : Fin c), a' n ci = f (a n ci)) :
                                  BUnif a' fun (k : Fin (2 * (c * h * w))) => f (v k)

                                  a pointwise activation preserves BUnif, value by value.

                                  theorem Proofs.BatchSeal.bnMean_pair (m : ) (hm : 0 < m) (a : Fin 2) (z : Vec (2 * m)) (hz : ∀ (n : Fin 2) (q : Fin m), z (finProdFinEquiv (n, q)) = a n) :
                                  bnMean (2 * m) z = (a 0 + a 1) / 2
                                  theorem Proofs.BatchSeal.bnBatchLA_pair {oc h w : } (hhw : 0 < h * w) (ε : ) (γ β : Vec oc) (a : Fin 2Fin oc) (v : Vec (2 * (oc * h * w))) (hv : BUnif a v) (a' : Fin 2Fin oc) (ha : ∀ (n : Fin 2) (ci : Fin oc), a' n ci = β ci + γ ci * ((a n ci - (a 0 ci + a 1 ci) / 2) * bnIstd (2 * (h * w)) (bnRowLA 2 oc h w v ci) ε)) :
                                  BUnif a' (StableHLO.bnBatchLA 2 oc h w ε γ β v)
                                  noncomputable def Proofs.BatchSeal.swishD (x : ) :
                                  Equations
                                  Instances For
                                    theorem Proofs.BatchSeal.swishD_pos {x : } (hx : 0 x) :
                                    0 < swishD x
                                    theorem Proofs.BatchSeal.swishScalar_lt {a b : } (ha : 0 a) (hab : a < b) :
                                    noncomputable def Proofs.BatchSeal.swishGap (β u : ) :

                                    the two examples' swish outputs, as a function of half their gap.

                                    Equations
                                    Instances For
                                      @[simp]
                                      theorem Proofs.BatchSeal.swishGap_pos {β u : } (hu : 0 < u) (hub : u β) :
                                      0 < swishGap β u
                                      theorem Proofs.BatchSeal.bnIstd_le_one {n : } (z : Vec n) :
                                      bnIstd n z 1 1

                                      with ε = 1 a batch istd is at most 1, which keeps the ray's gap inside the window swishGap_pos needs.