proofs
Provedattentionformal-verificationfinite-sampler

Complete finite certified attention

For all n,d,e∈N\htmlData{mx=1}{n, d, e \in \htmlData{mx=0}{\mathbb{N}}}, A,q∈Key⁡ d\htmlData{mx=3}{A, q \in \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Key}}\,\htmlData{mx=1}{d}}}, k:Fin⁡ n→Key⁡ d\htmlData{mx=7}{k : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{n}} \mathrel{\htmlData{mx=6}{\to}} \htmlData{mx=5}{\htmlData{mx=3}{\operatorname{Key}}\,\htmlData{mx=4}{d}}}, v:Fin⁡ n→EuclideanSpace⁡ R Fin⁡ e\htmlData{mx=10}{v : \htmlData{mx=2}{\htmlData{mx=0}{\operatorname{Fin}}\,\htmlData{mx=1}{n}} \mathrel{\htmlData{mx=9}{\to}} \htmlData{mx=8}{\htmlData{mx=3}{\operatorname{EuclideanSpace}}\,\htmlData{mx=4}{\mathbb{R}}\,\htmlData{mx=7}{\htmlData{mx=5}{\operatorname{Fin}}\,\htmlData{mx=6}{e}}}} and F,Q,δ,ε∈R\htmlData{mx=1}{F, Q, \delta, \varepsilon \in \htmlData{mx=0}{\mathbb{R}}}, if 0<n0 \mathrel{\htmlData{mx=1}{<}} \htmlData{mx=0}{n}, 0<d0 \mathrel{\htmlData{mx=1}{<}} \htmlData{mx=0}{d}, 0≤F0 \mathrel{\htmlData{mx=1}{\leq}} \htmlData{mx=0}{F}, 0<Q0 \mathrel{\htmlData{mx=1}{<}} \htmlData{mx=0}{Q}, 0<δ0 \mathrel{\htmlData{mx=1}{<}} \htmlData{mx=0}{\delta}, δ≤1\htmlData{mx=0}{\delta} \mathrel{\htmlData{mx=1}{\leq}} 1, 0<ε0 \mathrel{\htmlData{mx=1}{<}} \htmlData{mx=0}{\varepsilon}, sum⁡(univ⁡,i↦(q(i))2)≤Q2\htmlData{mx=7}{\htmlData{mx=0}{\operatorname{sum}}(\htmlData{mx=1}{\operatorname{univ}}, \htmlData{mx=6}{i \mapsto \htmlData{mx=5}{(\htmlData{mx=4}{\htmlData{mx=2}{q}(\htmlData{mx=3}{i})})^{2}}})} \mathrel{\htmlData{mx=10}{\leq}} \htmlData{mx=9}{\htmlData{mx=8}{Q}^{2}} and ∀j, ∥v(j)∥≤F\htmlData{mx=6}{\forall j,\ \htmlData{mx=3}{\left\lVert \htmlData{mx=2}{\htmlData{mx=0}{v}(\htmlData{mx=1}{j})} \right\rVert} \mathrel{\htmlData{mx=5}{\leq}} \htmlData{mx=4}{F}}, then

(let⁡(w))(:=queryWidth d Q δ     let xs:=(inputRows k v).reverse     let s:=appendRows A w emptyBuffered xs     let prepared:=prepare A q w (bufferedEntries s.entries)     let M:=(cells A w k v).card     let law:=storedQueryWeight A q w k v F ε (Nat.clog 2 n)     let result:=storedQueryOutput A q w k v F ε (Nat.clog 2 n)     let κ:=queryKappa A q w k v F ε     bufferedInvariant A w s ∧     s.entries.length=M ∧ s.raw.data.size=n ∧     s.raw.capacity+memberCapacity s.entries≤4∗n ∧     updateWork A w e xs≤n∗(4∗(d+2)∗M+40∗(d+1)∗(e+1)+6) ∧     prepared.normalizer=normalizer A q w k v ∧ prepared.surrogateMean=controlB A q w k v ∧     prepared.control=controlC A q w k v ∧     (∀ z,0≤law z) ∧ (Finset.sum Finset.univ (fun z => law z))=1 ∧ mean law result=output q k v ∧     mse law result (output q k v)≤ε2ˆ ∧     (Finset.sum Finset.univ (fun z => law z∗billedWork n d e M (Nat.clog 2 n) κ z))≤     preparePrice n d e M+2∗κ∗(2∗keyPrice d e M+valuePrice e+densePrice d e+2∗e) ∧     κ≤36∗F2ˆ∗δ4ˆ/(25∗ε2ˆ)   ))\htmlData{mx=3}{(\htmlData{mx=2}{\htmlData{mx=0}{\operatorname{let}}(\htmlData{mx=1}{w})})(\mathtt{:=queryWidth\ d\ Q\ {\delta}\ \ \ \ \ let\ xs:=(inputRows\ k\ v).reverse\ \ \ \ \ let\ s:=appendRows\ A\ w\ emptyBuffered\ xs\ \ \ \ \ let\ prepared:=prepare\ A\ q\ w\ (bufferedEntries\ s.entries)\ \ \ \ \ let\ M:=(cells\ A\ w\ k\ v).card\ \ \ \ \ let\ law:=storedQueryWeight\ A\ q\ w\ k\ v\ F\ {\varepsilon}\ (Nat.clog\ 2\ n)\ \ \ \ \ let\ result:=storedQueryOutput\ A\ q\ w\ k\ v\ F\ {\varepsilon}\ (Nat.clog\ 2\ n)\ \ \ \ \ let\ {\kappa}:=queryKappa\ A\ q\ w\ k\ v\ F\ {\varepsilon}\ \ \ \ \ bufferedInvariant\ A\ w\ s\ \text{∧}\ \ \ \ \ s.entries.length=M\ \text{∧}\ s.raw.data.size=n\ \text{∧}\ \ \ \ \ s.raw.capacity+memberCapacity\ s.entries\leq 4*n\ \text{∧}\ \ \ \ \ updateWork\ A\ w\ e\ xs\leq n*(4*(d+2)*M+40*(d+1)*(e+1)+6)\ \text{∧}\ \ \ \ \ prepared.normalizer=normalizer\ A\ q\ w\ k\ v\ \text{∧}\ prepared.surrogateMean=controlB\ A\ q\ w\ k\ v\ \text{∧}\ \ \ \ \ prepared.control=controlC\ A\ q\ w\ k\ v\ \text{∧}\ \ \ \ \ (\forall \ z,0\leq law\ z)\ \text{∧}\ (Finset.sum\ Finset.univ\ (fun\ z\ =>\ law\ z))=1\ \text{∧}\ mean\ law\ result=output\ q\ k\ v\ \text{∧}\ \ \ \ \ mse\ law\ result\ (output\ q\ k\ v)\leq {\varepsilon}\^2\ \text{∧}\ \ \ \ \ (Finset.sum\ Finset.univ\ (fun\ z\ =>\ law\ z*billedWork\ n\ d\ e\ M\ (Nat.clog\ 2\ n)\ {\kappa}\ z))\leq \ \ \ \ \ preparePrice\ n\ d\ e\ M+2*{\kappa}*(2*keyPrice\ d\ e\ M+valuePrice\ e+densePrice\ d\ e+2*e)\ \text{∧}\ \ \ \ \ {\kappa}\leq 36*F\^2*{\delta}\^4/(25*{\varepsilon}\^2)\ \ \ )})}
What the notation means · or point at any symbol
NNatural numbers
The natural numbers 0, 1, 2, …. In Lean they start at 0. (ℕ)
x ∈ TVariables
n, d, e range over natural numbers: the statement must hold for every choice. ((n d e : ℕ))
Key
Key: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Key)
f(x)Function application
Key applied to d. Lean writes f x; papers write f(x). (Key d)
Fin
Fin: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Fin)
⟹Implies
If Fin(n), then Key(d). (Between types, A → B is the type of functions from A to B.) (Fin n → Key d)
<Less than
0 is strictly smaller than n. (0<n)
≤At most
0 is less than or equal to F. (0≤F)
sum
Finset.sum: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Finset.sum)
∀For all
The statement after the comma holds for every j. (∀ j,‖v j‖≤F)
‖v‖Norm
The length (size) of v(j). (‖v j‖)
let
let: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (let)
EuclideanSpace
EuclideanSpace: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (EuclideanSpace)
univ
Finset.univ: a definition from the library, not special notation. Its name is its meaning; open it in Lean to see how it is defined. (Finset.univ)
RReal numbers
The real numbers: every point on the number line. (ℝ)
x ↦ f(x)Function (λ-abstraction)
The function sending i to q(i)^2. Lean writes fun x => …; papers write x ↦ …. (fun i => (q i)^2)
aᵇPower
q(i) raised to the power 2. ((q i)^2)

Exact-real table variant: constructed append summaries and maintained preparation, actual stored sampler, original-softmax vector unbiasedness/MSE, capacity/update/query counters, explicit quartic scale. Numerical Rust and faster balanced-map refinements excluded.

How it was proved

Proved
6 October 2026
By
Ajax
Checked by
Lean's kernel (Lean 4.33.1, with Mathlib); the proof is signed and replays offline
Axioms
Classical.choice, Quot.sound, propext
Proof
36 lines of Lean
Sign in to see the proofThe proof, its signed report and its history.

More proved statements