Documentation

LeanMlir.Proofs.Training.BatchSealKit

The batch-BatchNorm seal kit — non-degeneracy machinery for the full-width nets #

The level-2/3 witnesses (Training/JacobianSeal.lean's backward_nontrivial_of_fderiv_ne) on 2-channel per-example proxies see a BatchNorm that is bnForward over one activation. The nets the ImageNet artifacts actually run normalize with StableHLO.bnBatchLA — bnBatchTensor4 at the network's left-assoc index, i.e. bnPerChannelFlat oc (N·h·w): each channel over all its batch-and-spatial cells. This file is the machinery for sealing those, shared by the four kinked full-width nets (ResNet-34/50, MobileNetV2/V4).

Why the carrier has to change, and what that costs #

A proxy seal carries a channel difference: channel 0 = channel 1 + δ at every position. Under per-channel batch BN that carrier dies — a channel-uniform offset is exactly what the channel's own mean subtracts — and at N = 1 the structural net is constant in its input outright. So the carrier here is an example difference (EDiff in the per-net files): example 0's slab is example 1's slab plus δ, per channel. Batch BN keeps it and scales it by γ_c · istd_c (bnBatchLA_exdiff), because the two examples share one mean and one istd. That forces N = 2 and makes the witness exercise the one op that couples examples.

The cost is that every fact now has to be read at a cell (n, c, i, j) of a left-assoc flat index. §1 pays that once: bcell is the per-example Tensor3 view, bnRowLA is the row BN normalizes, and bnBatchLA_bcell is the bridge. Everything after it is the usual BN algebra on one row.

What is here #

noncomputable def Proofs.BatchSeal.bcell {N c h w : ℕ} (v : Vec (N * (c * h * w))) (n : Fin N) :
Tensor3 c h w

Example n's [C,H,W] slab of a batched activation Vec (N·(c·h·w)). Every per-cell statement in a batched seal is about this.

Equations
Instances For
    noncomputable def Proofs.BatchSeal.bfrom {N c h w : ℕ} (f : Fin N → Tensor3 c h w) :
    Vec (N * (c * h * w))

    Assemble a batched activation from per-example slabs — the inverse of bcell, used to write the witness input down.

    Equations
    Instances For
      theorem Proofs.BatchSeal.bcell_bfrom {N c h w : ℕ} (f : Fin N → Tensor3 c h w) (n : Fin N) :
      bcell (bfrom f) n = f n
      theorem Proofs.BatchSeal.bcell_smul {N c h w : ℕ} (t : ℝ) (v : Vec (N * (c * h * w))) (n : Fin N) (ci : Fin c) (i : Fin h) (j : Fin w) :
      bcell (t • v) n ci i j = t * bcell v n ci i j
      theorem Proofs.BatchSeal.bcell_pool {N c h w : ℕ} (x : Vec (N * (c * (2 * h) * (2 * w)))) (n : Fin N) :

      The batched 3×3/s2 pool, slab by slab.

      theorem Proofs.BatchSeal.row_batchMap {N a b : ℕ} (f : Vec a → Vec b) (x : Vec (N * a)) (n : Fin N) :

      batchMap at a per-example output that is read as a plain Vec (the head's GAP/dense).

      noncomputable def Proofs.BatchSeal.laIdx (N oc h w : ℕ) (n : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
      Fin (N * (oc * h * w))

      The network's left-assoc [N,C,H,W] flat index.

      Equations
      Instances For
        theorem Proofs.BatchSeal.bcell_eq_laIdx {N oc h w : ℕ} (v : Vec (N * (oc * h * w))) (n : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
        bcell v n c i j = v (laIdx N oc h w n c i j)
        noncomputable def Proofs.BatchSeal.bnRowLA (N oc h w : ℕ) (v : Vec (N * (oc * h * w))) (c : Fin oc) :
        Vec (N * (h * w))

        The row batch BN normalizes: channel c's N·h·w cells, over the whole batch.

        Equations
        Instances For
          theorem Proofs.BatchSeal.bnBatchLA_bcell_eq_of_eq {N oc h w : ℕ} (ε : ℝ) (γ β : Vec oc) (v : Vec (N * (oc * h * w))) (n : Fin N) (c : Fin oc) (i j : Fin h) (i' j' : Fin w) (heq : bcell v n c i i' = bcell v n c j j') :
          bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n c i i' = bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n c j j'

          Batch BN keeps equal cells equal within one example and channel: the per-channel affine map reads nothing of a cell but its value. What lets a tie between two stem cells that read identical input patches survive every BN parameter (StemConvTwin in ResNet34ParamGrad).

          theorem Proofs.BatchSeal.bnBatchLA_const {N oc h w : ℕ} (hn : 0 < N * (h * w)) (ε : ℝ) (γ β : Vec oc) (b c₀ : ℝ) (hβ : ∀ (ci : Fin oc), β ci = b) (k : Fin (N * (oc * h * w))) :
          StableHLO.bnBatchLA N oc h w ε γ β (fun (x : Fin (N * (oc * h * w))) => c₀) k = b

          A constant channel normalizes to β (variance 0, xhat = 0): a zeroed residual body is the constant β₂, whatever γ₂ is. The batched peer of bnForward_const.

          theorem Proofs.BatchSeal.bnBatchLA_pos {N oc h w : ℕ} (ε : ℝ) (hε : 0 < ε) (γ β : Vec oc) (g b : ℝ) (hγ : ∀ (ci : Fin oc), γ ci = g) (hβ : ∀ (ci : Fin oc), β ci = b) (hm : |g| * √↑(N * (h * w)) < b) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          0 < StableHLO.bnBatchLA N oc h w ε γ β v k

          Positivity from the margin — |g|√(N·h·w) < b makes the whole BN output strictly positive, at every input. The relu clause of every conv-bn-relu stage in the witness.

          theorem Proofs.BatchSeal.bnBatchLA_window {N oc h w : ℕ} (ε : ℝ) (hε : 0 < ε) (γ β : Vec oc) (g b : ℝ) (hγ : ∀ (ci : Fin oc), γ ci = g) (hβ : ∀ (ci : Fin oc), β ci = b) (hlo : |g| * √↑(N * (h * w)) < b) (hhi : b + |g| * √↑(N * (h * w)) < 6) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          0 < StableHLO.bnBatchLA N oc h w ε γ β v k ∧ StableHLO.bnBatchLA N oc h w ε γ β v k < 6

          The relu6 window from the margin — the two-sided twin of bnBatchLA_pos. With β = b strictly inside (|g|√(N·h·w), 6 − |g|√(N·h·w)) the whole BN output sits strictly inside (0, 6), at every input, so relu6_id_window collapses the stage that follows it. b = 3 centres the window and makes both hypotheses the single check |g|√(N·h·w) < 3.

          theorem Proofs.BatchSeal.bnBatchLA_smooth6 {N oc h w : ℕ} (ε : ℝ) (hε : 0 < ε) (γ β : Vec oc) (g b : ℝ) (hγ : ∀ (ci : Fin oc), γ ci = g) (hβ : ∀ (ci : Fin oc), β ci = b) (hlo : |g| * √↑(N * (h * w)) < b) (hhi : b + |g| * √↑(N * (h * w)) < 6) (v : Vec (N * (oc * h * w))) (k : Fin (N * (oc * h * w))) :
          StableHLO.bnBatchLA N oc h w ε γ β v k ≠ 0 ∧ StableHLO.bnBatchLA N oc h w ε γ β v k ≠ 6

          Both relu6 clauses at once, in the ≠ 0 ∧ ≠ 6 shape every MobileNet smoothness bundle is stated in. Since the bound is input-independent, this discharges a relu6 clause without reading the activation — which is why a relu6 net's whole clause bundle is weight-only.

          theorem Proofs.BatchSeal.bnBatchLA_exdiff {N oc h w : ℕ} (ε : ℝ) (γ β : Vec oc) (v : Vec (N * (oc * h * w))) (n₀ n₁ : Fin N) (c : Fin oc) (i : Fin h) (j : Fin w) :
          bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n₀ c i j - bcell (StableHLO.bnBatchLA N oc h w ε γ β v) n₁ c i j = γ c * (bcell v n₀ c i j - bcell v n₁ c i j) * bnIstd (N * (h * w)) (bnRowLA N oc h w v c) ε

          The carrier step. Two examples of one channel share the channel's mean and istd, so batch BN keeps their difference and multiplies it by γ_c · istd_c. This is what a channel-difference carrier cannot do under per-channel batch BN, and it is why the witness is at N = 2.

          noncomputable def Proofs.BatchSeal.ctK (oc ic kH kW : ℕ) (s : ℝ) :
          Kernel4 oc ic kH kW

          The centre-tap broadcast kernel. Every output channel reads input channel 0 through the kernel's centre tap, scaled by s; every other tap is zero.

          Only the centre tap, and that is the point: conv2d pads with zeros, so a conv of a constant is not constant near the border — but the centre tap kh = (kH−1)/2 reads position hi itself, which is in range at every output cell. So this kernel is transparent to a uniform offset at every position, which a multi-tap kernel is not.

          Equations
          Instances For
            theorem Proofs.BatchSeal.batchMap_flatConv_zero {N ic oc h w kH kW : ℕ} (W : Kernel4 oc ic kH kW) (b : Vec oc) (hW : ∀ (o : Fin oc) (c : Fin ic) (kh : Fin kH) (kw : Fin kW), W o c kh kw = 0) (hb : ∀ (o : Fin oc), b o = 0) (x : Vec (N * (ic * h * w))) :
            StableHLO.batchMap N (flatConv W b) x = fun (x : Fin (N * (oc * h * w))) => 0

            A zeroed conv (zero kernel, zero bias) sends everything to the constant 0 — the residual bodies. flatConv_eq_zero lifted across the batch.

            theorem Proofs.BatchSeal.batchMap_flatConvStride2_zero {N ic oc h w kH kW : ℕ} (W : Kernel4 oc ic kH kW) (b : Vec oc) (hW : ∀ (o : Fin oc) (c : Fin ic) (kh : Fin kH) (kw : Fin kW), W o c kh kw = 0) (hb : ∀ (o : Fin oc), b o = 0) (x : Vec (N * (ic * (2 * h) * (2 * w)))) :
            StableHLO.batchMap N (flatConvStride2 W b) x = fun (x : Fin (N * (oc * h * w))) => 0

            A zeroed STRIDED conv sends everything to the constant 0 (decimation of a constant).

            noncomputable def Proofs.BatchSeal.ctDW (c kH kW : ℕ) (s : ℝ) :

            The centre-tap depthwise kernel: every channel reads itself through the kernel's centre tap, scaled by s. At s = 1, b = 0 it is the identity. The depthwise peer of ctK.

            Equations
            Instances For
              theorem Proofs.BatchSeal.forall_flat_of_cell {N c h w : ℕ} {v : Vec (N * (c * h * w))} {P : ℝ → Prop} (hc : ∀ (n : Fin N) (ci : Fin c) (i : Fin h) (j : Fin w), P (bcell v n ci i j)) (k : Fin (N * (c * h * w))) :
              P (v k)

              Cellwise ⇒ flatwise. A property of every cell (n, c, i, j) holds at every flat index — the bridge from the bcell view back to the ∀ k shape every clause is stated in.

              theorem Proofs.BatchSeal.bnRowLA_continuous (N oc h w : ℕ) (c : Fin oc) :
              Continuous fun (v : Vec (N * (oc * h * w))) => bnRowLA N oc h w v c

              bnRowLA is continuous in the activation — it is a reindex.

              noncomputable def Proofs.BatchSeal.kv (c : ℕ) (x : ℝ) :
              Vec c

              A channel-constant BN parameter. Every structural witness's γ and β are one of these, which is what lets bnBatchLA_pointwise's property be channel-independent.

              Equations
              Instances For
                @[simp]
                theorem Proofs.BatchSeal.kv_apply (c : ℕ) (x : ℝ) (i : Fin c) :
                kv c x i = x
                noncomputable def Proofs.BatchSeal.zk (oc ic kH kW : ℕ) :
                Kernel4 oc ic kH kW

                The zero kernel — every residual body.

                Equations
                Instances For
                  noncomputable def Proofs.BatchSeal.dzk (c kH kW : ℕ) :

                  The zero depthwise kernel — an inverted-residual net's zeroed bodies.

                  Equations
                  Instances For
                    theorem Proofs.BatchSeal.margin160 (n : ℕ) (h : ↑n < 25600) :
                    |1| * √↑n < 160

                    1 · √n < 160 whenever n < 25600 — the margin bnBatchLA_pos consumes, at γ = 1, β = 160. Every BN width of a 224×224 ResNet witness clears it (the widest is the stem's 2·112² = 25088).

                    theorem Proofs.BatchSeal.margin192 (n : ℕ) (h : ↑n < 36864) :
                    |1 / 64| * √↑n < 3

                    |1/64|·√n < 3 whenever n < 36864 = (3·64)² — the relu6 margin bnBatchLA_smooth6 consumes, at γ = 1/64, β = 3. It clears both of that lemma's hypotheses at once, β = 3 being the centre of (0, 6). Every relu6 BN width of a 224×224 MobileNetV2 witness fits: the widest is 2·112² = 25088, shared by the stem, b1's depthwise and b2's expand.

                    noncomputable def Proofs.BatchSeal.rayV (H W : ℕ) :
                    Vec (2 * (3 * H * W))

                    The perturbation: all of example 0's channel 0. Uniform over the spatial grid, so it survives a max-pool for every t (maxPool3s2_shift) with no argmax argument.

                    Equations
                    Instances For
                      noncomputable def Proofs.BatchSeal.rayX (H W : ℕ) (t : ℝ) :
                      Vec (2 * (3 * H * W))

                      The witness input, as a ray through the base.

                      Equations
                      Instances For
                        theorem Proofs.BatchSeal.rayX_zero_add (H W : ℕ) (t : ℝ) :
                        rayX H W 0 + t • rayV H W = rayX H W t

                        The ray is continuous in its parameter.

                        def Proofs.BatchSeal.EDiff {c h w : ℕ} (δ : Fin c → ℝ) (v : Vec (2 * (c * h * w))) :

                        The carrier: example 0's slab is example 1's plus the per-channel constant δ. The replacement for a channel difference, which per-channel batch BN annihilates.

                        δ is a FUNCTION of the channel, not one scalar, and that is what makes it cheap: BN multiplies channel c's offset by γ_c · istd_c with no need to prove the channels share an istd, a centre-tap conv collapses the whole function to fun _ => s · δ 0, and only δ 0 is ever read (by the head, and at each channel-changing conv).

                        Equations
                        Instances For
                          theorem Proofs.BatchSeal.eDiff_rayX (H W : ℕ) (t : ℝ) :
                          EDiff (fun (ci : Fin 3) => if ↑ci = 0 then t else 0) (rayX H W t)

                          The ray's carrier: t in channel 0, nothing elsewhere.

                          theorem Proofs.BatchSeal.eDiff_shift {c h w : ℕ} (δ : Fin c → ℝ) (v : Vec (2 * (c * h * w))) (s : ℝ) (hv : EDiff δ v) :
                          EDiff δ fun (k : Fin (2 * (c * h * w))) => v k + s

                          A batch-uniform shift (a zeroed residual body) is transparent to the carrier.

                          theorem Proofs.BatchSeal.eDiff_bn (oc h w : ℕ) (ε : ℝ) (γ β : Vec oc) (δ δ' : Fin oc → ℝ) (v : Vec (2 * (oc * h * w))) (hv : EDiff δ v) (hδ : ∀ (ci : Fin oc), δ' ci = γ ci * δ ci * bnIstd (2 * (h * w)) (bnRowLA 2 oc h w v ci) ε) :
                          EDiff δ' (StableHLO.bnBatchLA 2 oc h w ε γ β v)

                          Batch BN scales the carrier by γ_c · istd_c — the two examples share the channel's mean and istd, so centring keeps their difference (bnBatchLA_exdiff).

                          theorem Proofs.BatchSeal.eDiff_conv {ic oc h w kH kW : ℕ} (c₀ : Fin ic) (hc₀ : ↑c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ℝ) (b : Vec oc) (δ : Fin ic → ℝ) (δ' : Fin oc → ℝ) (v : Vec (2 * (ic * h * w))) (hv : EDiff δ v) (hδ : ∀ (o : Fin oc), δ' o = s * δ c₀) :
                          EDiff δ' (StableHLO.batchMap 2 (flatConv (ctK oc ic kH kW s) b) v)

                          A centre-tap conv copies channel 0's offset to every output channel, and is transparent to the zero padding because only the centre tap is nonzero.

                          theorem Proofs.BatchSeal.eDiff_convS2 {ic oc h w kH kW : ℕ} (c₀ : Fin ic) (hc₀ : ↑c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ℝ) (b : Vec oc) (δ : Fin ic → ℝ) (δ' : Fin oc → ℝ) (v : Vec (2 * (ic * (2 * h) * (2 * w)))) (hv : EDiff δ v) (hδ : ∀ (o : Fin oc), δ' o = s * δ c₀) :
                          EDiff δ' (StableHLO.batchMap 2 (flatConvStride2 (ctK oc ic kH kW s) b) v)

                          The strided peer of eDiff_conv.

                          theorem Proofs.BatchSeal.eDiff_convS2Xla {ic oc h w kH kW : ℕ} (c₀ : Fin ic) (hc₀ : ↑c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (s : ℝ) (b : Vec oc) (δ : Fin ic → ℝ) (δ' : Fin oc → ℝ) (v : Vec (2 * (ic * (2 * h) * (2 * w)))) (hv : EDiff δ v) (hδ : ∀ (o : Fin oc), δ' o = s * δ c₀) :
                          EDiff δ' (StableHLO.batchMap 2 (flatConvStride2Xla (ctK oc ic kH kW s) b) v)

                          The XLA-SAME strided peer of eDiff_conv — MobileNetV2's stem.

                          theorem Proofs.BatchSeal.eDiff_dw {c h w kH kW : ℕ} (hkH : 0 < kH) (hkW : 0 < kW) (s : ℝ) (b : Vec c) (δ δ' : Fin c → ℝ) (v : Vec (2 * (c * h * w))) (hv : EDiff δ v) (hδ : ∀ (ch : Fin c), δ' ch = s * δ ch) :
                          EDiff δ' (StableHLO.batchMap 2 (depthwiseFlat (ctDW c kH kW s) b) v)

                          A centre-tap depthwise scales the carrier channel by channel. Unlike eDiff_conv, which collapses δ to the single value s * δ c₀ at every output channel, a depthwise reads only its own channel, so the whole function δ survives, scaled.

                          theorem Proofs.BatchSeal.eDiff_pool (c h w : ℕ) (δ : Fin c → ℝ) (v : Vec (2 * (c * (2 * h) * (2 * w)))) (hv : EDiff δ v) :

                          The 3×3/s2 pool keeps the carrier, at every t.

                          noncomputable def Proofs.BatchSeal.ctConv (oc kH kW h w : ℕ) (t : ℝ) :
                          Vec (2 * (oc * (2 * h) * (2 * w)))

                          The witness's strided centre-tap stem conv — the pre-BN activation on the carrier's path.

                          Equations
                          • One or more equations did not get rendered due to their size.
                          Instances For
                            theorem Proofs.BatchSeal.ctConv_bn_pos (oc kH kW h w : ℕ) (hm : |1| * √↑(2 * (2 * h * (2 * w))) < 160) (t : ℝ) (k : Fin (2 * (oc * (2 * h) * (2 * w)))) :
                            0 < StableHLO.bnBatchLA 2 oc (2 * h) (2 * w) 1 (kv oc 1) (kv oc 160) (ctConv oc kH kW h w t) k

                            The stem BN is strictly positive at every point of the ray (the β = 160 margin).

                            theorem Proofs.BatchSeal.ctConv_pool_smooth (oc kH kW h w : ℕ) (hkH : 0 < kH) (hkW : 0 < kW) (t : ℝ) (n : Fin 2) :
                            MaxPool3s2Smooth (bcell (StableHLO.bnBatchLA 2 oc (2 * h) (2 * w) 1 (kv oc 1) (kv oc 160) (ctConv oc kH kW h w t)) n)

                            The stem pool has no tie at the witness: BN is injective within a channel (bnBatchLA_cell_inj) and the pre-BN activation is positionally injective. Stated in the ∀ example, MaxPool3s2Smooth (slab) shape the nets' *PoolSmoothAt unfolds to.

                            theorem Proofs.BatchSeal.head_diff_ct {c h w nCls : ℕ} (hh : 0 < h) (hw : 0 < w) (c₀ : Fin c) (hc₀ : ↑c₀ = 0) (j : Fin nCls) (Wd : Mat c nCls) (bd : Vec nCls) (hWd : ∀ (ci : Fin c), Wd ci j = if ↑ci = 0 then 1 else 0) (hbd : bd j = 0) (v : Vec (2 * (c * h * w))) (δ : Fin c → ℝ) (hv : EDiff δ v) :

                            GAP and the dense head deliver the carrier to one class: GAP of a uniformly shifted channel is shifted by the same constant, and a Wd that reads channel c₀ into class j turns the per-channel carrier into δ c₀. Stated on the batchMaps a *HeadB unfolds to, so every net's head instantiates it.

                            def Proofs.BatchSeal.BUnif {c h w : ℕ} (a : Fin 2 → Fin c → ℝ) (v : Vec (2 * (c * h * w))) :
                            Equations
                            Instances For
                              theorem Proofs.BatchSeal.eDiff_convBn {ic oc h w kH kW : ℕ} (c₀ : Fin ic) (hc₀ : ↑c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (γ0 β0 : ℝ) (Z : Vec (2 * (oc * h * w))) {δ : Fin ic → ℝ} {δ' : Fin oc → ℝ} {v : Vec (2 * (ic * h * w))} (hv : EDiff δ v) (hZ : Z = StableHLO.batchMap 2 (flatConv (ctK oc ic kH kW 1) (kv oc 0)) v) (hδ : ∀ (ci : Fin oc), δ' ci = γ0 * δ c₀ * bnIstd (2 * (h * w)) (bnRowLA 2 oc h w Z ci) 1) :
                              EDiff δ' (StableHLO.bnBatchLA 2 oc h w 1 (kv oc γ0) (kv oc β0) Z)

                              A centre-tap 1×1 (or kH×kW) conv, then its BatchNorm: the carrier is channel c₀'s offset times γ0 · istd, at every output channel.

                              theorem Proofs.BatchSeal.eDiff_convS2Bn {ic oc h w kH kW : ℕ} (c₀ : Fin ic) (hc₀ : ↑c₀ = 0) (hkH : 0 < kH) (hkW : 0 < kW) (γ0 β0 : ℝ) (Z : Vec (2 * (oc * h * w))) {δ : Fin ic → ℝ} {δ' : Fin oc → ℝ} {v : Vec (2 * (ic * (2 * h) * (2 * w)))} (hv : EDiff δ v) (hZ : Z = StableHLO.batchMap 2 (flatConvStride2 (ctK oc ic kH kW 1) (kv oc 0)) v) (hδ : ∀ (ci : Fin oc), δ' ci = γ0 * δ c₀ * bnIstd (2 * (h * w)) (bnRowLA 2 oc h w Z ci) 1) :
                              EDiff δ' (StableHLO.bnBatchLA 2 oc h w 1 (kv oc γ0) (kv oc β0) Z)

                              The strided peer of eDiff_convBn.

                              theorem Proofs.BatchSeal.eDiff_dwBn {c h w kH kW : ℕ} (hkH : 0 < kH) (hkW : 0 < kW) (γ0 β0 : ℝ) (Z : Vec (2 * (c * h * w))) {δ δ' : Fin c → ℝ} {v : Vec (2 * (c * h * w))} (hv : EDiff δ v) (hZ : Z = StableHLO.batchMap 2 (depthwiseFlat (ctDW c kH kW 1) (kv c 0)) v) (hδ : ∀ (ci : Fin c), δ' ci = γ0 * δ ci * bnIstd (2 * (h * w)) (bnRowLA 2 c h w Z ci) 1) :
                              EDiff δ' (StableHLO.bnBatchLA 2 c h w 1 (kv c γ0) (kv c β0) Z)

                              A centre-tap depthwise conv, then its BatchNorm: channel by channel, δ ci · γ0 · istd.

                              theorem Proofs.BatchSeal.eDiff_dwS2Bn {c h w kH kW : ℕ} (hkH : 0 < kH) (hkW : 0 < kW) (γ0 β0 : ℝ) (Z : Vec (2 * (c * h * w))) {δ δ' : Fin c → ℝ} {v : Vec (2 * (c * (2 * h) * (2 * w)))} (hv : EDiff δ v) (hZ : Z = StableHLO.batchMap 2 (depthwiseStride2Flat (ctDW c kH kW 1) (kv c 0)) v) (hδ : ∀ (ci : Fin c), δ' ci = γ0 * δ ci * bnIstd (2 * (h * w)) (bnRowLA 2 c h w Z ci) 1) :
                              EDiff δ' (StableHLO.bnBatchLA 2 c h w 1 (kv c γ0) (kv c β0) Z)

                              The strided peer of eDiff_dwBn.

                              theorem Proofs.BatchSeal.eDiff_dwS2XlaBn {c h w kH kW : ℕ} (hkH : 0 < kH) (hkW : 0 < kW) (γ0 β0 : ℝ) (Z : Vec (2 * (c * h * w))) {δ δ' : Fin c → ℝ} {v : Vec (2 * (c * (2 * h) * (2 * w)))} (hv : EDiff δ v) (hZ : Z = StableHLO.batchMap 2 (depthwiseStride2FlatXla (ctDW c kH kW 1) (kv c 0)) v) (hδ : ∀ (ci : Fin c), δ' ci = γ0 * δ ci * bnIstd (2 * (h * w)) (bnRowLA 2 c h w Z ci) 1) :
                              EDiff δ' (StableHLO.bnBatchLA 2 c h w 1 (kv c γ0) (kv c β0) Z)

                              The XLA-SAME strided peer of eDiff_dwBn.

                              theorem Proofs.BatchSeal.eDiff_of_bUnif {c h w : ℕ} (a : Fin 2 → Fin c → ℝ) (δ : Fin c → ℝ) (v : Vec (2 * (c * h * w))) (hv : BUnif a v) (hδ : ∀ (ci : Fin c), δ ci = a 0 ci - a 1 ci) :
                              EDiff δ v

                              Stage facts first needed by ResNet-34's seal, shared by every conv-net seal #

                              The zero-kernel collapse, the relu-free strided stage, the centre-tap projection witness (sealProj). Stage continuity needs no lemma here: the op files tag their continuity facts @[fun_prop], and each seal's Rr_continuous is one fun_prop. The namespace is ResNet-34's, kept so that every citation keeps its name.

                              theorem Proofs.BatchSeal.projB_zero_const {N ic oc h w kH kW : ℕ} (hn : 0 < N * (h * w)) (W : Kernel4 oc ic kH kW) (b : Vec oc) (hW : ∀ (o : Fin oc) (c : Fin ic) (kh : Fin kH) (kw : Fin kW), W o c kh kw = 0) (hb : ∀ (o : Fin oc), b o = 0) (ε : ℝ) (γ β : Vec oc) (bb : ℝ) (hβ : ∀ (ci : Fin oc), β ci = bb) (u : Vec (N * (ic * h * w))) :
                              projB N W b ε γ β u = fun (x : Fin (N * (oc * h * w))) => bb

                              A zeroed final conv makes a body the constant β₂ — projB at a zero kernel is bnBatchLA of the constant 0, which is β₂ (variance 0). Used for both block kinds.

                              noncomputable def Proofs.BatchSeal.sealProj (N h w ic oc : ℕ) :
                              Vec (N * (ic * (2 * h) * (2 * w))) → Vec (N * (oc * h * w))

                              The structural downsample's collapsed form: its centre-tap projection.

                              Equations
                              Instances For
                                theorem Proofs.BatchSeal.sealProj_pos (N h w ic oc : ℕ) (hm : |1| * √↑(N * (h * w)) < 160) (v : Vec (N * (ic * (2 * h) * (2 * w)))) (k : Fin (N * (oc * h * w))) :
                                0 < sealProj N h w ic oc v k

                                The projection is strictly positive at every input (the β = 160 margin).

                                theorem Proofs.BatchSeal.cbReluStridedB_eq {N ic oc h w kH kW : ℕ} (W : Kernel4 oc ic kH kW) (b : Vec oc) (ε : ℝ) (γ β : Vec oc) (x : Vec (N * (ic * (2 * h) * (2 * w)))) (hp : ∀ (k : Fin (N * (oc * h * w))), 0 < StableHLO.bnBatchLA N oc h w ε γ β (StableHLO.batchMap N (flatConvStride2 W b) x) k) :

                                A strided conv-bn-relu stage whose BN is everywhere positive has no relu left.

                                theorem Proofs.BatchSeal.sealProj_apply (N h w ic oc : ℕ) (v : Vec (N * (ic * (2 * h) * (2 * w)))) :
                                sealProj N h w ic oc v = StableHLO.bnBatchLA N oc h w 1 (kv oc 1) (kv oc 160) (StableHLO.batchMap N (flatConvStride2 (ctK oc ic 1 1 1) (kv oc 0)) v)

                                sealProj, unfolded — bn of the centre-tap strided conv.