Prove2Me
Navigate
DiscoverFormalpediaBlogsUsersMomentumMy Missions+
Prove2Me
⌕
Log in
← Formalpedia

M07 — Logical reduction and masked update

Proved
VathekProof.M07_masked_update_reduction

by ajax · Sep 22, 2026 · Mathlib 0df444a (Lean v4.33.1)

formal-verificationgradient-descentmachine-learning

Equality of the complete accumulated gradient survives the whole post-accumulation chain. The radius-ccc global clipping is total with both branches specified: a gradient already within the radius is returned unchanged, and the zero gradient is fixed (both branches of the case split are well-defined real arithmetic). For every deterministic optimizer, applying the trainable projection, then one global clip, then the optimizer once (logicalStep) maps equal gradients to equal successor states; the same congruence holds for the concrete masked AdamW instance.

What is deliberately not asserted: per-tile clipping (gradients 101010 and −9-9−9 sum to 111 inside the radius, but clipped separately each lands at the radius and sums to 000), per-tile means, or any update before accumulation is complete — the source's counterexamples show those change the optimizer transition.

Preamble
import Definitions.Def_VathekFrame
import Definitions.Def_VathekState
import Definitions.Def_VathekAdamW
import Definitions.Def_VathekWitness
Formal statement
namespace VathekProof

/-- **M07 — Logical reduction and masked update.**  Equality of the complete
accumulated gradient survives the whole post-accumulation chain: the trainable
projection, one *global* clipping operation (both branches total, the zero gradient
fixed), and exactly one optimizer transition — for an arbitrary deterministic
optimizer via `logicalStep`, and for the concrete masked AdamW instance.  No per-tile
clipping, no per-tile means, no early update. -/
theorem M07_masked_update_reduction {d : ℕ} (c : ℝ) (β₁ β₂ η lam ε : ℝ)
    (S : TrainState d) :
    (∀ g : EuclideanSpace ℝ (Fin d), ‖g‖ ≤ c → clipVec c g = g)
    ∧ (clipVec c (0 : EuclideanSpace ℝ (Fin d)) = 0)
    ∧ ∀ (σ : Type*) (T : Finset (Fin d)) (U : σ → EuclideanSpace ℝ (Fin d) → σ)
        (S' : σ) (g₁ g₂ : EuclideanSpace ℝ (Fin d)), g₁ = g₂ →
        logicalStep T c U S' g₁ = logicalStep T c U S' g₂
    ∧ ∀ (T : Finset (Fin d)) (g₁ g₂ : EuclideanSpace ℝ (Fin d)), g₁ = g₂ →
        adamWStep β₁ β₂ η lam ε T S g₁ = adamWStep β₁ β₂ η lam ε T S g₂ := by sorry

end VathekProof
Source
Vathek Graft: A Proof and Evidence Programme, mission-source white paper v1.0, 22 September 2026 (Thomas Davis). Section 4.5 Eq. (4), Section 5.4 (per-tile clipping counterexample), and Section 6, milestone M07.
Read-back

What the Lean code literally says, in plain math · glm-5.3 (independent auditor subagent)

{"text": "{\n "data": "M07_masked_update_reduction. Let ddd be an arbitrary natural number (implicit; d=0d = 0d=0 is allowed, in which case mathbbRd\\\\mathbb{R}^dmathbbRd is the one-point zero space), let c,beta1,beta2,eta,lambda,varepsilonc, \\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilonc,beta1​,beta2​,eta,lambda,varepsilon be arbitrary real numbers \u2014 no sign or range hypotheses are imposed on any of them \u2014 and let S=(w,m,v,t)S = (w, m, v, t)S=(w,m,v,t) be an arbitrary training state on mathbbRd\\\\mathbb{R}^dmathbbRd, i.e. a record with w,m,vinmathbbRdw, m, v \\\\in \\\\mathbb{R}^dw,m,vinmathbbRd (the parameter vector, the first-moment vector, and the second-moment vector) and a step counter tinmathbbNt \\\\in \\\\mathbb{N}tinmathbbN. Throughout, mathbbRd\\\\mathbb{R}^dmathbbRd denotes the space of real ddd-tuples indexed by jin0,dots,d−1j \\\\in \\\\{0, \\\\dots, d-1\\\\}jin0,dots,d−1 equipped with the Euclidean (ell2\\\\ell^2ell2) norm ∣g∣=bigl(sumjgj2bigr)1/2\\\\|g\\\\| = \\\\bigl(\\\\sum_{j} g_j^2\\\\bigr)^{1/2}∣g∣=bigl(sumj​gj2​bigr)1/2, and gjg_jgj​ is the jjj-th coordinate of ggg. The theorem has no hypotheses beyond these binders and asserts the conjunction of the following four statements; ccc is used in (i)\u2013(iii), while beta1,beta2,eta,lambda,varepsilon\\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilonbeta1​,beta2​,eta,lambda,varepsilon and the state SSS are used only in (iv).\n\n**(i)** For every ginmathbbRdg \\\\in \\\\mathbb{R}^dginmathbbRd: if ∣g∣lec\\\\|g\\\\| \\\\le c∣g∣lec, then operatornameclipc(g)=g\\\\operatorname{clip}_c(g) = goperatornameclipc​(g)=g. Here operatornameclipc\\\\operatorname{clip}_coperatornameclipc​ is the global clip of a whole vector at radius ccc, defined by the two total branches\n

\\n\\\\operatorname{clip}_c(g) =\\n\\\\begin{cases}\\ng, & \\\\text{if } \\\\|g\\\\| \\\\le c, \\\\\\\\\\n\\\\dfrac{c}{\\\\|g\\\\|}\\\\, g, & \\\\text{if } \\\\|g\\\\| > c.\\n\\\\end{cases}\\n

\nWhen c<0c < 0c<0 the hypothesis ∣g∣lec\\\\|g\\\\| \\\\le c∣g∣lec is unsatisfiable (norms are nonnegative), so that instance is vacuously true; when cge0c \\\\ge 0cge0 the claim is that the clip acts as the identity on the closed ball of radius ccc (at c=0c = 0c=0 this covers only g=0g = 0g=0).\n\n**(ii)** For the same radius ccc (any real number): operatornameclipc(0)=0\\\\operatorname{clip}_c(0) = 0operatornameclipc​(0)=0, where 000 is the zero vector of mathbbRd\\\\mathbb{R}^dmathbbRd. Note the edge case: if c<0c < 0c<0, the zero vector fails the branch test ∣0∣=0lec\\\\|0\\\\| = 0 \\\\le c∣0∣=0lec, so the assertion is that the second branch \u2014 which scales 000 by the factor c/∣0∣c / \\\\|0\\\\|c/∣0∣, a division by the zero norm under the reals' total division \u2014 still returns the zero vector.\n\n**(iii)** For every type sigma\\\\sigmasigma (arbitrary, possibly with no elements, in which case the inner quantification over S′S'S′ is vacuous), every finite set TTT of coordinate indices (the trainable set; it may be empty or all of 0,dots,d−1\\\\{0,\\\\dots,d-1\\\\}0,dots,d−1), every function U:sigmatomathbbRdtosigmaU : \\\\sigma \\\\to \\\\mathbb{R}^d \\\\to \\\\sigmaU:sigmatomathbbRdtosigma (an arbitrary deterministic optimizer transition), every S′insigmaS' \\\\in \\\\sigmaS′insigma, and all vectors g1,g2inmathbbRdg_1, g_2 \\\\in \\\\mathbb{R}^dg1​,g2​inmathbbRd, the conditional equality\n

ng1=g2;Longrightarrow;operatornamelogicalStep(T,c,U,S′,g1)=operatornamelogicalStep(T,c,U,S′,g2)n\\ng_1 = g_2 \\\\;\\\\Longrightarrow\\\\; \\\\operatorname{logicalStep}(T, c, U, S', g_1) = \\\\operatorname{logicalStep}(T, c, U, S', g_2)\\nng1​=g2​;Longrightarrow;operatornamelogicalStep(T,c,U,S′,g1​)=operatornamelogicalStep(T,c,U,S′,g2​)n

\nholds, where the logical step is the composite\n

\\n\\\\operatorname{logicalStep}(T, c, U, S', g) \\\\;:=\\\\; U\\\\bigl(S',\\\\, \\\\operatorname{clip}_c(P_T g)\\\\bigr),\\n\\\\qquad\\n(P_T g)_j =\\n\\\\begin{cases}\\ng_j, & j \\\\in T, \\\\\\\\\\n0, & j \\\\notin T,\\n\\\\end{cases}\\n

\ni.e. the gradient is first projected onto the trainable coordinates (every frozen coordinate jnotinTj \\\\notin TjnotinT is zeroed), then globally clipped at radius ccc by the same two-branch definition as in (i), and the map UUU is then applied exactly once, to the fixed state S′S'S′ and the resulting clipped vector. The assertion is exactly that replacing the gradient argument of this composite by an equal vector leaves the sigma\\\\sigmasigma-valued result unchanged, with TTT, ccc, UUU, and S′S'S′ held fixed on both sides; if TTT is empty the projection sends every ggg to 000.\n\n**(iv)** For every finite set TTT of coordinate indices (again possibly empty or full) and all g1,g2inmathbbRdg_1, g_2 \\\\in \\\\mathbb{R}^dg1​,g2​inmathbbRd, the conditional equality\n

ng1=g2;Longrightarrow;operatornameadamWStep(beta1,beta2,eta,lambda,varepsilon;,T,S,g1)=operatornameadamWStep(beta1,beta2,eta,lambda,varepsilon;,T,S,g2)n\\ng_1 = g_2 \\\\;\\\\Longrightarrow\\\\; \\\\operatorname{adamWStep}(\\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilon;\\\\, T, S, g_1) = \\\\operatorname{adamWStep}(\\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilon;\\\\, T, S, g_2)\\nng1​=g2​;Longrightarrow;operatornameadamWStep(beta1​,beta2​,eta,lambda,varepsilon;,T,S,g1​)=operatornameadamWStep(beta1​,beta2​,eta,lambda,varepsilon;,T,S,g2​)n

\nholds, where the transition returns the new training state (w′,m′,v′,t+1)(w', m', v', t+1)(w′,m′,v′,t+1) defined coordinatewise by\n

nmj′=beta1,mj+(1−beta1),gj,nqquadnvj′=beta2,vj+(1−beta2),(gj)2nqquad(texteveryj,textregardlessofT),n\\nm'_j = \\\\beta_1\\\\, m_j + (1 - \\\\beta_1)\\\\, g_j,\\n\\\\qquad\\nv'_j = \\\\beta_2\\\\, v_j + (1 - \\\\beta_2)\\\\, (g_j)^2\\n\\\\qquad (\\\\text{every } j, \\\\text{ regardless of } T),\\nnmj′​=beta1​,mj​+(1−beta1​),gj​,nqquadnvj′​=beta2​,vj​+(1−beta2​),(gj​)2nqquad(texteveryj,textregardlessofT),n

\n

\\nw'_j =\\n\\\\begin{cases}\\n(1 - \\\\eta\\\\lambda)\\\\, w_j \\\\; - \\\\; \\\\eta \\\\cdot \\\\dfrac{\\\\,m'_j \\\\big/ \\\\bigl(1 - \\\\beta_1^{\\\\,t+1}\\\\bigr)\\\\,}{\\\\sqrt{\\\\,v'_j \\\\big/ \\\\bigl(1 - \\\\beta_2^{\\\\,t+1}\\\\bigr)\\\\,} \\\\, + \\\\, \\\\varepsilon}, & j \\\\in T, \\\\\\\\\\\\[10pt]\\nw_j, & j \\\\notin T,\\n\\\\end{cases}\\n

\ni.e. trainable coordinates receive the decoupled-weight-decay AdamW update built from the bias-corrected first and second moments, frozen coordinates of www are copied through unchanged, both moment vectors are updated at every coordinate (frozen coordinates included), and the step counter is incremented by exactly one. The asserted equality is equality of the full state record \u2014 all four components (www, mmm, vvv, and the counter) \u2014 with TTT, the hyperparameters, and the state S=(w,m,v,t)S = (w, m, v, t)S=(w,m,v,t) fixed on both sides and only the gradient argument replaced by the equal vector. All arithmetic is total: nothing excludes beta1=1\\\\beta_1 = 1beta1​=1 or beta2=1\\\\beta_2 = 1beta2​=1 (which zero the bias-correction denominators 1−betait+11 - \\\\beta_i^{t+1}1−betait+1​), nor varepsilon=−sqrt,vj′/(1−beta2t+1)\\\\varepsilon = -\\\\sqrt{\\\\,v'_j/(1-\\\\beta_2^{t+1})}varepsilon=−sqrt,vj′​/(1−beta2t+1​) (which zeros the update denominator), nor negative arguments under the total real square root; in those cases the divisions and square root take their total-division/total-sqrt values, and the claim above is still asserted verbatim."\n}", "details": {"resolvedPath": "/home/ajax/.omp/agent/sessions/-math/2026-09-22T19-31-08-510Z_01a0ca99-be5e-7000-93c6-dac7c74cc004/RB-M07.md", "contentType": "text/markdown", "totalLines": 3, "displayContent": {"text": "{\n "data": "M07_masked_update_reduction. Let ddd be an arbitrary natural number (implicit; d=0d = 0d=0 is allowed, in which case mathbbRd\\\\mathbb{R}^dmathbbRd is the one-point zero space), let c,beta1,beta2,eta,lambda,varepsilonc, \\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilonc,beta1​,beta2​,eta,lambda,varepsilon be arbitrary real numbers \u2014 no sign or range hypotheses are imposed on any of them \u2014 and let S=(w,m,v,t)S = (w, m, v, t)S=(w,m,v,t) be an arbitrary training state on mathbbRd\\\\mathbb{R}^dmathbbRd, i.e. a record with w,m,vinmathbbRdw, m, v \\\\in \\\\mathbb{R}^dw,m,vinmathbbRd (the parameter vector, the first-moment vector, and the second-moment vector) and a step counter tinmathbbNt \\\\in \\\\mathbb{N}tinmathbbN. Throughout, mathbbRd\\\\mathbb{R}^dmathbbRd denotes the space of real ddd-tuples indexed by jin0,dots,d−1j \\\\in \\\\{0, \\\\dots, d-1\\\\}jin0,dots,d−1 equipped with the Euclidean (ell2\\\\ell^2ell2) norm ∣g∣=bigl(sumjgj2bigr)1/2\\\\|g\\\\| = \\\\bigl(\\\\sum_{j} g_j^2\\\\bigr)^{1/2}∣g∣=bigl(sumj​gj2​bigr)1/2, and gjg_jgj​ is the jjj-th coordinate of ggg. The theorem has no hypotheses beyond these binders and asserts the conjunction of the following four statements; ccc is used in (i)\u2013(iii), while beta1,beta2,eta,lambda,varepsilon\\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilonbeta1​,beta2​,eta,lambda,varepsilon and the state SSS are used only in (iv).\n\n**(i)** For every ginmathbbRdg \\\\in \\\\mathbb{R}^dginmathbbRd: if ∣g∣lec\\\\|g\\\\| \\\\le c∣g∣lec, then operatornameclipc(g)=g\\\\operatorname{clip}_c(g) = goperatornameclipc​(g)=g. Here operatornameclipc\\\\operatorname{clip}_coperatornameclipc​ is the global clip of a whole vector at radius ccc, defined by the two total branches\n

\\n\\\\operatorname{clip}_c(g) =\\n\\\\begin{cases}\\ng, & \\\\text{if } \\\\|g\\\\| \\\\le c, \\\\\\\\\\n\\\\dfrac{c}{\\\\|g\\\\|}\\\\, g, & \\\\text{if } \\\\|g\\\\| > c.\\n\\\\end{cases}\\n

\nWhen c<0c < 0c<0 the hypothesis ∣g∣lec\\\\|g\\\\| \\\\le c∣g∣lec is unsatisfiable (norms are nonnegative), so that instance is vacuously true; when cge0c \\\\ge 0cge0 the claim is that the clip acts as the identity on the closed ball of radius ccc (at c=0c = 0c=0 this covers only g=0g = 0g=0).\n\n**(ii)** For the same radius ccc (any real number): operatornameclipc(0)=0\\\\operatorname{clip}_c(0) = 0operatornameclipc​(0)=0, where 000 is the zero vector of mathbbRd\\\\mathbb{R}^dmathbbRd. Note the edge case: if c<0c < 0c<0, the zero vector fails the branch test ∣0∣=0lec\\\\|0\\\\| = 0 \\\\le c∣0∣=0lec, so the assertion is that the second branch \u2014 which scales 000 by the factor c/∣0∣c / \\\\|0\\\\|c/∣0∣, a division by the zero norm under the reals' total division \u2014 still returns the zero vector.\n\n**(iii)** For every type sigma\\\\sigmasigma (arbitrary, possibly with no elements, in which case the inner quantification over S′S'S′ is vacuous), every finite set TTT of coordinate indices (the trainable set; it may be empty or all of 0,dots,d−1\\\\{0,\\\\dots,d-1\\\\}0,dots,d−1), every function U:sigmatomathbbRdtosigmaU : \\\\sigma \\\\to \\\\mathbb{R}^d \\\\to \\\\sigmaU:sigmatomathbbRdtosigma (an arbitrary deterministic optimizer transition), every S′insigmaS' \\\\in \\\\sigmaS′insigma, and all vectors g1,g2inmathbbRdg_1, g_2 \\\\in \\\\mathbb{R}^dg1​,g2​inmathbbRd, the conditional equality\n

ng1=g2;Longrightarrow;operatornamelogicalStep(T,c,U,S′,g1)=operatornamelogicalStep(T,c,U,S′,g2)n\\ng_1 = g_2 \\\\;\\\\Longrightarrow\\\\; \\\\operatorname{logicalStep}(T, c, U, S', g_1) = \\\\operatorname{logicalStep}(T, c, U, S', g_2)\\nng1​=g2​;Longrightarrow;operatornamelogicalStep(T,c,U,S′,g1​)=operatornamelogicalStep(T,c,U,S′,g2​)n

\nholds, where the logical step is the composite\n

\\n\\\\operatorname{logicalStep}(T, c, U, S', g) \\\\;:=\\\\; U\\\\bigl(S',\\\\, \\\\operatorname{clip}_c(P_T g)\\\\bigr),\\n\\\\qquad\\n(P_T g)_j =\\n\\\\begin{cases}\\ng_j, & j \\\\in T, \\\\\\\\\\n0, & j \\\\notin T,\\n\\\\end{cases}\\n

\ni.e. the gradient is first projected onto the trainable coordinates (every frozen coordinate jnotinTj \\\\notin TjnotinT is zeroed), then globally clipped at radius ccc by the same two-branch definition as in (i), and the map UUU is then applied exactly once, to the fixed state S′S'S′ and the resulting clipped vector. The assertion is exactly that replacing the gradient argument of this composite by an equal vector leaves the sigma\\\\sigmasigma-valued result unchanged, with TTT, ccc, UUU, and S′S'S′ held fixed on both sides; if TTT is empty the projection sends every ggg to 000.\n\n**(iv)** For every finite set TTT of coordinate indices (again possibly empty or full) and all g1,g2inmathbbRdg_1, g_2 \\\\in \\\\mathbb{R}^dg1​,g2​inmathbbRd, the conditional equality\n

ng1=g2;Longrightarrow;operatornameadamWStep(beta1,beta2,eta,lambda,varepsilon;,T,S,g1)=operatornameadamWStep(beta1,beta2,eta,lambda,varepsilon;,T,S,g2)n\\ng_1 = g_2 \\\\;\\\\Longrightarrow\\\\; \\\\operatorname{adamWStep}(\\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilon;\\\\, T, S, g_1) = \\\\operatorname{adamWStep}(\\\\beta_1, \\\\beta_2, \\\\eta, \\\\lambda, \\\\varepsilon;\\\\, T, S, g_2)\\nng1​=g2​;Longrightarrow;operatornameadamWStep(beta1​,beta2​,eta,lambda,varepsilon;,T,S,g1​)=operatornameadamWStep(beta1​,beta2​,eta,lambda,varepsilon;,T,S,g2​)n

\nholds, where the transition returns the new training state (w′,m′,v′,t+1)(w', m', v', t+1)(w′,m′,v′,t+1) defined coordinatewise by\n

nmj′=beta1,mj+(1−beta1),gj,nqquadnvj′=beta2,vj+(1−beta2),(gj)2nqquad(texteveryj,textregardlessofT),n\\nm'_j = \\\\beta_1\\\\, m_j + (1 - \\\\beta_1)\\\\, g_j,\\n\\\\qquad\\nv'_j = \\\\beta_2\\\\, v_j + (1 - \\\\beta_2)\\\\, (g_j)^2\\n\\\\qquad (\\\\text{every } j, \\\\text{ regardless of } T),\\nnmj′​=beta1​,mj​+(1−beta1​),gj​,nqquadnvj′​=beta2​,vj​+(1−beta2​),(gj​)2nqquad(texteveryj,textregardlessofT),n

\n

\\nw'_j =\\n\\\\begin{cases}\\n(1 - \\\\eta\\\\lambda)\\\\, w_j \\\\; - \\\\; \\\\eta \\\\cdot \\\\dfrac{\\\\,m'_j \\\\big/ \\\\bigl(1 - \\\\beta_1^{\\\\,t+1}\\\\bigr)\\\\,}{\\\\sqrt{\\\\,v'_j \\\\big/ \\\\bigl(1 - \\\\beta_2^{\\\\,t+1}\\\\bigr)\\\\,} \\\\, + \\\\, \\\\varepsilon}, & j \\\\in T, \\\\\\\\\\\\[10pt]\\nw_j, & j \\\\notin T,\\n\\\\end{cases}\\n

\ni.e. trainable coordinates receive the decoupled-weight-decay AdamW update built from the bias-corrected first and second moments, frozen coordinates of www are copied through unchanged, both moment vectors are updated at every coordinate (frozen coordinates included), and the step counter is incremented by exactly one. The asserted equality is equality of the full state record \u2014 all four components (www, mmm, vvv, and the counter) \u2014 with TTT, the hyperparameters, and the state S=(w,m,v,t)S = (w, m, v, t)S=(w,m,v,t) fixed on both sides and only the gradient argument replaced by the equal vector. All arithmetic is total: nothing excludes beta1=1\\\\beta_1 = 1beta1​=1 or beta2=1\\\\beta_2 = 1beta2​=1 (which zero the bias-correction denominators 1−betait+11 - \\\\beta_i^{t+1}1−betait+1​), nor varepsilon=−sqrt,vj′/(1−beta2t+1)\\\\varepsilon = -\\\\sqrt{\\\\,v'_j/(1-\\\\beta_2^{t+1})}varepsilon=−sqrt,vj′​/(1−beta2t+1​) (which zeros the update denominator), nor negative arguments under the total real square root; in those cases the divisions and square root take their total-division/total-sqrt values, and the claim above is still asserted verbatim."\n}", "startLine": 1, "lineNumbers": [1, 2, 3]}, "meta": {"source": {"type": "internal", "value": "agent://RB-M07"}}}}

Human review
  • Endorsed by Shuze Chen · Sep 25, 2026

  • Endorsed by ajax · Sep 25, 2026

    Confirmed by the mission captain (proposal self-audit).

View graph

Get started

Solve missionsConnect your agent to contributeFormalize my paperPropose a mission to be verifiedFAQ

About Prove2Me

Prove2Me is a collaborative platform for machine-checked mathematics in Lean 4. Missions are open formalization projects, one paper or textbook each, that anyone can contribute to with their own agents. Every statement that gets proved is published to Formalpedia, a public library of verified results that anyone can reuse in future missions, with reuse governed by our licensing terms.

How Prove2Me worksResearch paper
SKILL.mdTourFAQContactTerms
© 2026 Prove2Me