Provedalphabaguettenoether-checksumcontrast

Why classic ABFT cannot catch wrong-buffer bugs: its checksum identity holds for EVERY operand

For all $\htmlData{mx=1}{I, K, J \in \htmlData{mx=0}{\mathbb{N}}}$ , $\htmlData{mx=9}{A : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{I}} \mathrel{\htmlData{mx=8}{\to}} \htmlData{mx=5}{\htmlData{mx=3}{\operatorname{Fin}}\,\htmlData{mx=4}{K}} \mathrel{\htmlData{mx=7}{\to}} \htmlData{mx=6}{\mathbb{R}}}$ , $\htmlData{mx=9}{B : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{K}} \mathrel{\htmlData{mx=8}{\to}} \htmlData{mx=5}{\htmlData{mx=3}{\operatorname{Fin}}\,\htmlData{mx=4}{J}} \mathrel{\htmlData{mx=7}{\to}} \htmlData{mx=6}{\mathbb{R}}}$ and $\htmlData{mx=3}{j \in \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{J}}}$ :

\htmlData{mx=10}{\sum_{i} \htmlData{mx=9}{\sum_{k} \htmlData{mx=8}{\htmlData{mx=3}{\htmlData{mx=0}{A}(\htmlData{mx=1}{i}, \htmlData{mx=2}{k})} \cdot \htmlData{mx=7}{\htmlData{mx=4}{B}(\htmlData{mx=5}{k}, \htmlData{mx=6}{j})}}}} \mathrel{\htmlData{mx=22}{=}} \htmlData{mx=21}{\sum_{k} \htmlData{mx=20}{\left(\htmlData{mx=15}{\sum_{i} \htmlData{mx=14}{\htmlData{mx=11}{A}(\htmlData{mx=12}{i}, \htmlData{mx=13}{k})}}\right) \cdot \htmlData{mx=19}{\htmlData{mx=16}{B}(\htmlData{mx=17}{k}, \htmlData{mx=18}{j})}}}

What the notation means · or point at any symbol

NNatural numbers: The natural numbers 0, 1, 2, …. In Lean they start at 0. (ℕ)
x ∈ TVariables: I, K, J range over natural numbers: the statement must hold for every choice. ((I K J : ℕ))
Fin: Fin: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Fin)
f(x)Function application: Fin applied to I. Lean writes f x; papers write f(x). (Fin I)
=Equality: ∑ i, ∑ k, A(i, k) · B(k, j) and ∑ k, (∑ i, A(i, k)) · B(k, j) are the same. (∑ i, ∑ k, A i k * B k j = ∑ k, (∑ i, A …)
∑Summation: Add up A(i, k) · B(k, j) for every k. (∑ k, A i k * B k j)
⟹Implies: If Fin(K), then ℝ. (Between types, A → B is the type of functions from A to B.) (Fin K → ℝ)
·Multiplication: A(i, k) times B(k, j). (A i k * B k j)
RReal numbers: The real numbers: every point on the number line. (ℝ)

theorem nc-abft-is-operand-agnostic {I K J : ℕ} (A : Fin I → Fin K → ℝ) (B : Fin K → Fin J → ℝ) (j : Fin J) :
    ∑ i, ∑ k, A i k * B k j = ∑ k, (∑ i, A i k) * B k j

ABFT (Huang & Abraham 1984; ATTNChecker for attention) checks 1ᵀ(A·B) = (1ᵀA)·B. This identity holds for any B, including a wrongly-laid-out or stale buffer, so a kernel that multiplies the wrong operand is self-consistent and passes. In the experiment ABFT on key-backward's dP = dO·Vᵀ shows the clean residual on both Baguette bugs B1 (wrong V layout) and B2 (overwritten dO). The symmetry checksums are tied to the true derivative and catch both. Part of 'Noether checksums for Baguette's backward kernels'.

How it was proved

Proved: 3 October 2026
By: Ajax, with the agent “Baguette math & proofs (Claude Code, 2026-10-03)”
Checked by: Lean's kernel (Lean 4.33.1, with Mathlib); the proof is signed and replays offline
Axioms: Classical.choice, Quot.sound, propext
Proof: 13 lines of Lean

Why classic ABFT cannot catch wrong-buffer bugs: its checksum identity holds for EVERY operand

How it was proved

More proved statements