Provedalphabaguettenoether-checksumreview-2

Backward checksums see FORWARD bugs: if the saved log-normalizer is corrupted, C2's residual is Σᵢ(Σⱼ Pᵢⱼ − 1)·dOᵢ

For all $\htmlData{mx=1}{T, D \in \htmlData{mx=0}{\mathbb{N}}}$ , $\htmlData{mx=9}{P : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{T}} \mathrel{\htmlData{mx=8}{\to}} \htmlData{mx=5}{\htmlData{mx=3}{\operatorname{Fin}}\,\htmlData{mx=4}{T}} \mathrel{\htmlData{mx=7}{\to}} \htmlData{mx=6}{\mathbb{R}}}$ , $\htmlData{mx=9}{\mathit{dO} : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{T}} \mathrel{\htmlData{mx=8}{\to}} \htmlData{mx=5}{\htmlData{mx=3}{\operatorname{Fin}}\,\htmlData{mx=4}{D}} \mathrel{\htmlData{mx=7}{\to}} \htmlData{mx=6}{\mathbb{R}}}$ and $\htmlData{mx=3}{c \in \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{D}}}$ :

\begin{aligned} & \htmlData{mx=17}{\htmlData{mx=11}{\sum_{j} \htmlData{mx=10}{\sum_{i} \htmlData{mx=9}{\htmlData{mx=4}{\htmlData{mx=1}{P}(\htmlData{mx=2}{i}, \htmlData{mx=3}{j})} \cdot \htmlData{mx=8}{\htmlData{mx=5}{\mathit{dO}}(\htmlData{mx=6}{i}, \htmlData{mx=7}{c})}}}} - \htmlData{mx=16}{\sum_{i} \htmlData{mx=15}{\htmlData{mx=12}{\mathit{dO}}(\htmlData{mx=13}{i}, \htmlData{mx=14}{c})}}} \\ & \quad \htmlData{mx=0}{=} \htmlData{mx=29}{\sum_{i} \htmlData{mx=28}{\left(\htmlData{mx=23}{\htmlData{mx=22}{\sum_{j} \htmlData{mx=21}{\htmlData{mx=18}{P}(\htmlData{mx=19}{i}, \htmlData{mx=20}{j})}} - 1}\right) \cdot \htmlData{mx=27}{\htmlData{mx=24}{\mathit{dO}}(\htmlData{mx=25}{i}, \htmlData{mx=26}{c})}}} \end{aligned}

What the notation means · or point at any symbol

NNatural numbers: The natural numbers 0, 1, 2, …. In Lean they start at 0. (ℕ)
x ∈ TVariables: T, D range over natural numbers: the statement must hold for every choice. ((T D : ℕ))
Fin: Fin: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Fin)
f(x)Function application: Fin applied to T. Lean writes f x; papers write f(x). (Fin T)
-Subtraction: ∑ j, ∑ i, P(i, j) · dO(i, c) minus ∑ i, dO(i, c). On ℕ, Lean's subtraction stops at 0: 2 − 5 = 0. (∑ j, ∑ i, P i j * dO i c - ∑ i, dO i c)
=Equality: (∑ j, ∑ i, P(i, j) · dO(i, c)) − (∑ i, dO(i, c)) and ∑ i, ((∑ j, P(i, j)) − 1) · dO(i, c) are the same. (∑ j, ∑ i, P i j * dO i c - ∑ i, dO i c …)
∑Summation: Add up P(i, j) · dO(i, c) for every i. (∑ i, P i j * dO i c)
⟹Implies: If Fin(T), then ℝ. (Between types, A → B is the type of functions from A to B.) (Fin T → ℝ)
·Multiplication: P(i, j) times dO(i, c). (P i j * dO i c)
RReal numbers: The real numbers: every point on the number line. (ℝ)

theorem nc2-c2-detects-unnormalized-probabilities {T D : ℕ} (P : Fin T → Fin T → ℝ) (dO : Fin T → Fin D → ℝ) (c : Fin D) :
    ∑ j, ∑ i, P i j * dO i c - ∑ i, dO i c = ∑ i, (∑ j, P i j - 1) * dO i c

FlashAttention-style backward recomputes P = exp(S − L) from the forward pass's saved log-normalizer L. Baguette's forward register-pair hazard overwrote L in 736 rows. For ANY P, Σⱼ dVⱼ − Σᵢ dOᵢ = Σᵢ (Σⱼ Pᵢⱼ − 1)·dOᵢ: rows whose recomputed probabilities no longer sum to 1 show up in C2 (305× in the experiment). C3 is blind to this case because both kernels share the same wrong P. Part of 'Noether checksums for Baguette's backward kernels' (review pass 2).

How it was proved

Proved: 4 October 2026
By: Ajax, with the agent “Baguette math & proofs (Claude Code, 2026-10-03)”
Checked by: Lean's kernel (Lean 4.33.1, with Mathlib); the proof is signed and replays offline
Axioms: Classical.choice, Quot.sound, propext
Proof: 15 lines of Lean

Backward checksums see FORWARD bugs: if the saved log-normalizer is corrupted, C2's residual is Σᵢ(Σⱼ Pᵢⱼ − 1)·dOᵢ

How it was proved

More proved statements