TorchLean API

NN.Proofs.RuntimeApprox.NF.Attention

Rounded scaled dot-product attention #

This module composes rounded-real NF bounds for attention's matrix operations and stable last-axis softmax. The unmasked forward theorem follows

softmax(c * (Q Kᵀ)) V,

where c is normally 1 / sqrt(d). Both the matrices and c may be approximate. The result is a single infinity-norm budget assembled from transpose, sequential matrix multiplication, coefficient-aware scaling, and row-softmax contracts. The current statements use the same feature width for queries, keys, and values; they do not prove a native or fused attention kernel.

NF keeps the ordinary rounded-real expression. Finite IEEE carriers can additionally replay scaled contractions and pullbacks from their original coefficients after range loss or absorption. The statements here do not establish that separate finite-codec execution path.

The theorem keeps the rounded coefficient error explicit. A caller may obtain it from the concrete construction of 1 / sqrt(d) or another proved coefficient bound. Backend metadata alone does not establish this hypothesis. Hiding the error would treat a rounded scale as an exact constant.

References:

The canonical 1 / sqrt(d) coefficient #

Half-ULP budget for embedding feature dimension d + 1 into NF.

Instances For

    Error budget for the rounded square root of the embedded feature dimension.

    Instances For

      Error budget for constructing 1 / sqrt(d + 1) in the rounded-real model.

      Instances For

        The canonical rounded attention scale approximates the exact real 1 / sqrt(d + 1).

        The accumulated square-root error must be smaller than one. This is a hypothesis about a noncomputable real-valued bound; the theorem does not automatically discharge it for a format.

        Error after the rounded score product Q Kᵀ.

        Instances For
          noncomputable def Proofs.RuntimeApprox.Attention.scaledScoreErrorBound {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} {nQ nK d : ℕ} (epsQ epsK epsScale : ℝ) (scaleR : FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (qR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nQ, d]) (kR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nK, d]) :

          Error after multiplying scores by an approximate runtime scale.

          Instances For

            Shared numerical certificate for the scaled score matrix scale * (Q Kᵀ).

            Both masked and unmasked attention use this prefix. Keeping it as one theorem also identifies the natural contract boundary for fused score kernels: a provider may replace the implementation as long as it supplies this same approximation statement.

            noncomputable def Proofs.RuntimeApprox.Attention.weightErrorBound {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} {nQ nK d : ℕ} (epsQ epsK epsScale : ℝ) (scaleR : FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (qR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nQ, d]) (kR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nK.succ, d]) :

            Error in the row-wise attention weights.

            Instances For
              noncomputable def Proofs.RuntimeApprox.Attention.outputErrorBound {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} {nQ nK d : ℕ} (epsQ epsK epsV epsScale : ℝ) (scaleR : FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (qR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nQ, d]) (kR vR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nK.succ, d]) :

              End-to-end output error for unmasked scaled dot-product attention.

              Instances For
                noncomputable def Proofs.RuntimeApprox.Attention.maskedWeightErrorBound {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} {nQ nK d : ℕ} (η epsMax : Fin nQ → ℝ) (rowMaxR : Fin nQ → FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (epsQ epsK epsScale : ℝ) (scaleR : FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (qR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nQ, d]) (kR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nK.succ, d]) (mask : TorchLean.Tensor Bool [nQ, nK.succ]) :

                Error in hard-masked attention weights, preserving one certificate record per query row.

                Instances For
                  noncomputable def Proofs.RuntimeApprox.Attention.maskedOutputErrorBound {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} {nQ nK d : ℕ} (η epsMax : Fin nQ → ℝ) (rowMaxR : Fin nQ → FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (epsQ epsK epsV epsScale : ℝ) (scaleR : FloatLib.Floats.Formats.Flocq.NF β fexp rnd) (qR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nQ, d]) (kR vR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nK.succ, d]) (mask : TorchLean.Tensor Bool [nQ, nK.succ]) :

                  End-to-end output error for hard-masked scaled dot-product attention.

                  Instances For
                    theorem Proofs.RuntimeApprox.Attention.approxTensor_hardMaskedScaledDotProductAttentionCore {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidRndToNearest rnd] {nQ nK d : ℕ} {qS : Spec.SpecTensor [nQ, d]} {kS vS : Spec.SpecTensor [nK.succ, d]} {qR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nQ, d]} {kR vR : TorchLean.Tensor (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) [nK.succ, d]} (mask : TorchLean.Tensor Bool [nQ, nK.succ]) {scaleS : ℝ} {scaleR : FloatLib.Floats.Formats.Flocq.NF β fexp rnd} {epsQ epsK epsV epsScale : ℝ} (hq : approxTensor NFBackend.toSpec qS qR epsQ) (hk : approxTensor NFBackend.toSpec kS kR epsK) (hv : approxTensor NFBackend.toSpec vS vR epsV) (hscale : |NFBackend.toSpec scaleR - scaleS| ≤ epsScale) (evidence : AxisSoftmax.HardMaskedRowsEvidence ((Spec.matMulSpec qS (TorchLean.Tensor.swapAdjacentAxes kS 0)).scaleSpec scaleS) ((Spec.matMulSpec qR (kR.swapAdjacentAxes 0)).scaleSpec scaleR) mask (scaledScoreErrorBound epsQ epsK epsScale scaleR qR kR)) :

                    Numerical forward theorem for hard-masked scaled dot-product attention.

                    Every query row must have an allowed key. This covers causal masks, where the diagonal is allowed; the all-blocked vector theorem remains available for APIs that intentionally permit empty rows. The selected allowed-row maxima and denominator margins are explicit certificate data, so no finite value is ever substituted for negative infinity.

                    Numerical forward theorem for the unmasked scaled-dot-product attention core.

                    hdenom supplies a bound for each rounded score row after matrix multiplication and scaling: the accumulated denominator error must remain below the exact lower bound one. It is a mathematical hypothesis, not an executable check performed by this theorem.

                    theorem Proofs.RuntimeApprox.Attention.approxTensor_scaledDotProductAttention_unmasked {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidRndToNearest rnd] {nQ nK d : ℕ} {hQ : nQ ≠ 0} {hK : nK.succ ≠ 0} (ctxS : Spec.AttentionContext ℝ nQ nK.succ d hQ hK) (ctxR : Spec.AttentionContext (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) nQ nK.succ d hQ hK) {epsQ epsK epsV epsScale : ℝ} (hmaskS : ctxS.mask = none) (hmaskR : ctxR.mask = none) (hq : approxTensor NFBackend.toSpec ctxS.Q ctxR.Q epsQ) (hk : approxTensor NFBackend.toSpec ctxS.K ctxR.K epsK) (hv : approxTensor NFBackend.toSpec ctxS.V ctxR.V epsV) (hscale : |NFBackend.toSpec (1 / Spec.attentionScaleDenom d) - 1 / Spec.attentionScaleDenom d| ≤ epsScale) (hdenom : ∀ (i : Fin nQ), AxisSoftmax.denominatorErrorBound (scaledScoreErrorBound epsQ epsK epsScale (1 / Spec.attentionScaleDenom d) ctxR.Q ctxR.K) (Spec.get ((Spec.matMulSpec ctxR.Q (ctxR.K.swapAdjacentAxes 0)).scaleSpec (1 / Spec.attentionScaleDenom d)) i) < 1) :

                    Canonical TorchLean attention corollary for the unmasked branch.

                    This theorem is stated directly over Spec.AttentionContext, so model proofs do not need to reconstruct the core expression by hand. The scale approximation and row-denominator checks are the numerical evidence attached to the runtime context.

                    theorem Proofs.RuntimeApprox.Attention.approxTensor_scaledDotProductAttention_masked {β : FloatLib.Numerics.Radix} {fexp : ℤ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidExp fexp] {rnd : ℝ → ℤ} [FloatLib.Floats.Formats.Flocq.ValidRndToNearest rnd] {nQ nK d : ℕ} {hQ : nQ ≠ 0} {hK : nK.succ ≠ 0} (ctxS : Spec.AttentionContext ℝ nQ nK.succ d hQ hK) (ctxR : Spec.AttentionContext (FloatLib.Floats.Formats.Flocq.NF β fexp rnd) nQ nK.succ d hQ hK) (mask : TorchLean.Tensor Bool [nQ, nK.succ]) {epsQ epsK epsV epsScale : ℝ} (hmaskS : ctxS.mask = some mask) (hmaskR : ctxR.mask = some mask) (hq : approxTensor NFBackend.toSpec ctxS.Q ctxR.Q epsQ) (hk : approxTensor NFBackend.toSpec ctxS.K ctxR.K epsK) (hv : approxTensor NFBackend.toSpec ctxS.V ctxR.V epsV) (hscale : |NFBackend.toSpec (1 / Spec.attentionScaleDenom d) - 1 / Spec.attentionScaleDenom d| ≤ epsScale) (evidence : AxisSoftmax.HardMaskedRowsEvidence ((Spec.matMulSpec ctxS.Q (ctxS.K.swapAdjacentAxes 0)).scaleSpec (1 / Spec.attentionScaleDenom d)) ((Spec.matMulSpec ctxR.Q (ctxR.K.swapAdjacentAxes 0)).scaleSpec (1 / Spec.attentionScaleDenom d)) mask (scaledScoreErrorBound epsQ epsK epsScale (1 / Spec.attentionScaleDenom d) ctxR.Q ctxR.K)) :
                    approxTensor NFBackend.toSpec (Spec.scaledDotProductAttention ctxS) (Spec.scaledDotProductAttention ctxR) (maskedOutputErrorBound evidence.eta evidence.epsMax evidence.rowMaxR epsQ epsK epsV epsScale (1 / Spec.attentionScaleDenom d) ctxR.Q ctxR.K ctxR.V mask)

                    Canonical TorchLean attention corollary for a shared hard mask.

                    The row certificate is tied to the scaled score matrices in the two contexts. Thus a certificate cannot be replayed against a different mask, scale, or set of parameters merely because the tensor shapes happen to agree.

                    Fully instantiated unmasked attention theorem for a positive feature dimension.

                    This corollary discharges the scale-coefficient approximation with approx_canonicalAttentionScale; callers supply tensor approximation hypotheses and the two error-margin proofs for square root and row normalization.