TransferMod

TransferMod develops a structural theory of how approximation guarantees transfer to derived scientific quantities.

The current release implements one reference application: exactly solvable compact U(1) spectral inference.

Scope. This is a methods note with an executable reference implementation. The theorems are stated for an arbitrary normed space, seminorm and functional; the numbers come from two worked instances. Applicability to reduced-order models, sketching, PDE surrogates and learned operators is a research programme, listed under "What remains" below and not claimed here.

The problem

Two errors, routinely confused. Approximation error is what validation measures: how far a surrogate is from the truth, aggregated over the state space. Error in the derived quantity is what a conclusion depends on: how far a spectral gap, transport coefficient, conserved observable or stability margin is from its true value.

A bound on the first is not a bound on the second. Scientific computing reports the first and reasons with the second, and nothing in the validation says how much the first controls the second.

  what validation establishes         ‖u′ − u‖_A  ≤  ε
                                             │
                                             │   ω      ← the transfer step
                                             ▼
  what the conclusion needs           |ΔQ| / |Q|  ≤  ω(ε)

Concretely: a reduced-order model is validated to 0.5% aggregate error and then used to predict a spectral gap. The transfer operator asks what the largest gap error still compatible with that validation is.

In the reference application, at the accepted aggregate tolerance ε = 5 × 10⁻³, that step gives ω(ε) = 0.95: validating to half a percent licenses a mass gap wrong by ninety-five percent. The certification procedure brings the same number to 0.024.

Given a validated approximation, what downstream conclusions are actually licensed?

The claim to evaluate

Aggregate approximation guarantees certify a derived quantity only through a single computable function of the tolerance — how large the error in that quantity can be, given the approximation error — and suitably designed gates control a restricted version of it.

The central object is the transfer operator T, which assigns each quantity of interest its least valid transfer guarantee. That guarantee is the fidelity modulus. The object of study is not the extremal modulus in isolation but the ordered space of admissible transfer guarantees. The structural results below establish the properties of T; the modulus is recovered as T(Q).

The structural core

Four results, on the operator T : Q ↦ ω_Q.

Canonical Decomposition (Proposition 1). Every valid guarantee is the fidelity modulus plus a determined amount of slack, and the split is unique: 𝒢 = {ω + s : s ≥ 0}. So the theorem describes not just the best guarantee but every one of them, and minimality of ω follows immediately. T is then the only operator returning the least guarantee at each Q (Corollary 1a).

Structural Calculus (Theorem A). How T behaves: monotone and local in its argument, stable under perturbation of Q, lax under composition and tensor products, monotone under restriction of the admissible set. One theorem rather than six facts — and eight of its ten items are properties of the supremum defining ω, only composition and the tensor bound needing separate estimates.

Restriction–Saturation (Theorem B). Certification is a closure operation on admissible perturbation families, because restriction and saturation form an adjoint pair.

Naturality (Corollary A3). T commutes with reparameterisation of the quantity of interest: exactly under affine h, laxly under Lipschitz h, and asymptotically under C¹ h, with the factor the relative derivative. Scale invariance is the degenerate case.

Together, the Canonical Decomposition Theorem and the Structural Calculus — with its companions, Restriction–Saturation and Naturality — form the structural foundation on which the analytic results rest. The core is order-theoretic: a least element, an adjunction, and the interval structure of down- and up-sets. The layer built on it is analytic — topological, differential and compactness arguments. The core makes those questions inevitable without supplying their answers: only Theorem 2 is downstream of the order itself.

What the order buys. Four results are not statable from "ω = inf 𝒢" alone: Theorem B's adjunction needs orders on two posets; Corollary B1's canonical form needs the closure it induces; Corollary A1's join/meet asymmetry needs lattice operations; and the slack decomposition needs 𝒢 to contain its infimum, since an unattained one gives no floor to measure slack from. What survives without the order is the certification criterion ω(ε₀) ≤ τ — the useful but unremarkable half.

What is new. The definition is not: ω is a worst-case relative sensitivity, and Theorem 3 identifies the classical condition number as ω′(0⁺). New are its status — Proposition 1 makes ω the unique minimal transfer guarantee, so every certification claim is a claim about it; the decomposition, which makes slack a computable quantity rather than a comparison; and the order, from which Theorem B's closure and Corollary A1's asymmetry between intersecting and widening admissible sets follow, neither being available bound-by-bound.

The analytic layer

Theorems 1–5 are built on that core: continuity, restriction, conditioning, second order, computation.

The five theorems answer successive questions about the same object:

Proposition 1   How are all valid guarantees organised?
Theorem 1       When does it vanish?
Theorem 2       What does certification recover when it does not?
Theorem 3       How does this relate to classical conditioning?
Theorem 4       Where does linearisation fail?
Theorem 5       When can the restricted modulus actually be computed?

Components and their roles

Component	Role
Transfer operator T : Q ↦ ω_Q	canonical assignment from quantities of interest to transfer guarantees
Fidelity modulus ω(ε)	canonical value of T; least transfer guarantee (Prop. 1)
Structural Calculus	algebraic behaviour of T (Thm A)
Restriction–Saturation	certification as closure (Thm B)
Naturality	T under reparameterisation of Q (Cor. A3)
Restricted modulus ω_D(ε)	why certification works (Thm 2)
Condition number κ_rel	infinitesimal derivative ω′(0⁺) (Thm 3)
Crossover scale ε_×	where linearisation fails (Thm 4)
Faint slow mode	constructive failure result
Spectral gate	domain-specific method
Compact U(1) model	exact reference instance
This package	executable realisation

Fidelity modulus

The definition. Any statement of the form "aggregate accuracy ε guarantees downstream accuracy τ" is a transfer guarantee. For an approximation seminorm ‖·‖_A, a quantity of interest Q : X → ℝ and a target u with Q(u) ≠ 0, the fidelity modulus is

ω(ε) = sup{ |Q(u′) − Q(u)| / |Q(u)| : ‖u′ − u‖_A ≤ ε }.

Why it is the right object. Proposition 1 shows ω is the smallest transfer guarantee: every valid one is at least as large, and none can be uniformly smaller. So every valid guarantee is bounded below by ω, and the claim "ε₀ implies τ" holds exactly when ω(ε₀) ≤ τ.

Its derivative is the condition number. Theorem 3: ω is right-differentiable at zero, and κ_rel = ω′(0⁺) is the classical relative condition number — so conditioning is the infinitesimal shadow of ω, not a separate object that ω extends. The regime this theory addresses is where κ_rel is finite but the linearisation has already failed at the tolerance in use: in the reference application κ_rel ≈ 4×10⁶, valid only for ε ≲ 2×10⁻⁷, four orders of magnitude below the 5×10⁻³ acceptance floor. Row 2 is not an edge case of classical first-order analysis; it is outside it.

Formal definitions and proofs are in paper/methods_reordered.md; transfermod.modulus computes ω and its thresholds along monotone one-parameter families.

Restricted certification result

A certification procedure accepts a set D; with D_ε = D ∩ B_ε(u), ω_D(ε) = sup{ e_Q(u′,u) : u′ ∈ D_ε }. Writing |𝓑(τ)| for the silent risk — the decades of perturbation amplitude that corrupt Q beyond τ yet are accepted:

Theorem 2: |𝓑(τ)| = 0 ⟺ ω_D ≤ τ (under monotonicity, and continuity of the error in the amplitude).

So a gate is not a heuristic screen: it computes a bound on a restricted modulus. Theorem 5 gives sufficient conditions for that bound to be computed rather than estimated: under coverage, ray monotonicity and Lipschitz dependence on direction, a grid of spacing δ brackets ω_D within Λδ. Once those hypotheses hold, coverage is the remaining structural obstruction — and the only one no computation can check — which is why every value reported here is written ω_{D,Θ}. Full statements and proofs in paper/methods_reordered.md.

Constructive failure

Proposition 4. For any bounded observation window, any positive reference spectral measure, any aggregate tolerance ε, and any 0 < ρ < 1, a mode of rate ρΔ and sufficiently small weight keeps the aggregate discrepancy under ε while moving the asymptotic rate to ρΔ. Equal-time moments are preserved exactly by renormalisation. The window bound is load-bearing.

Exact spectral experiment

Reference application: exactly solvable compact U(1) spectral inference — concretely, 2+1D Kogut–Susskind under exact diagonalisation on a 2×2 torus (Λ=2, g=1.0), so the mass gap is a true eigenvalue difference with no statistical error.

surrogate	conventional gates	spectral gates	reported gap	verdict
identity (echo)	pass	pass	1.96	CERTIFIED
reduced-transfer (ordinary, honest)	pass	pass	1.96	CERTIFIED
spectral-shortcut (constructed adversarial)	pass	fail	1.18	CONFOUND

The first two are honest surrogates and are certified (the gate does not raise false positives). The third is a constructed adversarial surrogate — an engineered spectral confound, not a learned model. It keeps the equal-time variance identical and its aggregate correlator RMSE (2.6e-3) sits below a realistic noise floor (5e-3), so every conventional check passes — while a fabricated faint slow mode pulls the effective-mass plateau ~40% below the true gap. The verdict is stable across the g/Λ nuisance sweep.

Left: correlators agree at short t (green) and the confound diverges only in the low-signal tail. Right: the honest surrogates plateau at the true gap; the constructed confound collapses to the spurious rate.

Reproduce with python scripts/run_pilot.py.

Non-physics instance: graph sparsification

The construction is not specific to physics or to surrogate models. scripts/run_graph_instance.py instantiates the same framework on weighted graphs: X = graphs on a fixed vertex set; ‖·‖_A = relative Frobenius error of the Laplacian (the aggregate quantity a cut-oriented sparsifier controls); Q = algebraic connectivity (the Fiedler value λ₂), read for clustering, mixing-time and robustness conclusions. The perturbation weakens the inter-cluster bridge edges while conserving total edge weight — what an aggressive sparsifier does when it undersamples low-effective-resistance structure. No physics, no surrogate; the script depends only on NumPy.

The pair sits in the same row 2 of the trichotomy as the spectral experiment, and the framework separates two certificates that both look "spectral": a sampled Rayleigh-quotient check leaves |𝓑| ≈ 0.89 decades of silent risk, while a Fiedler-directed check closes it to |𝓑| ≈ 0.013 decades. The per-stage composition slack (~3.6×) reproduces here as well. This is the evidence that the certificate separation is a property of the validation/quantity mismatch, not of the physics instance.

Reproduce with python scripts/run_graph_instance.py.

Install and run

pip install -e .            # or: pip install numpy scipy matplotlib
python scripts/run_pilot.py # prints the table, writes results/pilot.{json,png}
pytest -q                   # 60 tests

from transfermod.spectral import build_reference, certify

ref = build_reference(Lx=2, Ly=2, Lambda=2, g=1.0)
verdict = certify(ref, my_surrogate)
verdict.code   # CERTIFIED | CONFOUND | REJECTED | INSUFFICIENT_EVIDENCE

Gate results are three-valued (pass/fail/unmeasured); an unmeasured test is not a passing test, and downgrades the verdict to INSUFFICIENT_EVIDENCE.

Layout

src/transfermod/
  modulus/          fidelity moduli, thresholds, signatures   (domain-free)
  certification/    verdict codes                              (domain-free)
  spectral/         reference application (see below)          (implemented)
scripts/run_pilot.py           spectral reference experiment
scripts/run_graph_instance.py  non-physics instance (graph sparsification)
paper/methods_reordered.md     theorem-by-theorem development
docs/benchmark_details.md      surrogate taxonomy, architecture, extended results

sfbench remains importable as a deprecated alias for transfermod.spectral.

What this repository establishes

• formal definitions of transfer guarantee, fidelity modulus, certifiability;
• Proposition 1, Theorem A (structure) and Theorems 1, 2, 2′, 3, 4, 5 with proofs, for arbitrary normed spaces, seminorms and functionals: the canonical decomposition of the transfer guarantees (Prop. 1), the structural calculus (Thm A), the continuity characterisation and four-regime classification (Thm 1, Cor. 9), certification as restriction (Thm 2, 2′), first- and second-order conditioning (Thm 3, 4), and certified computability (Thm 5);
• scalar-family computations of ω, ω_D and the signature R = (|𝓘|, |𝓑|);
• a spectral certification implementation with a preregistered frozen gate;
• an exact reference experiment: a constructed surrogate passing every conventional check while reporting a mass gap ~40% low, detected without rejecting faithful controls; and an ordinary POD/Galerkin reduction reproducing the failure at ranks 2–5;
• a second, non-physics instance — graph sparsification with algebraic connectivity as the quantity of interest — exhibiting the same certificate separation (~0.89 vs ~0.013 decades of silent risk) with no surrogate model, evidence that the construction is domain-agnostic.

What remains a research program

• coverage: no perturbation family is proved to exhaust the certified set, so every computed value is ω_{D,Θ}, a lower bound on ω_D (Corollary 11). Every quantitative claim here is therefore family-dependent; a richer family could only raise ω_D, never lower it;
• composition slack of 3.6–4.5× per stage, which bounds a pipeline but does not budget one;
• a certified Lipschitz constant for the direction sweep, rather than an estimated one;
• other observable classes and quantities of interest;
• PDE, sketching and learned-operator applications (graph sparsification is already worked above; these remain);
• a randomised certification form reporting acceptance probability alongside the conditional accepted error, so a rarely-accepting gate cannot present a vacuously favourable conditional guarantee;
• certification gates designed to minimise |𝓑| rather than tested afterwards;
• cross-domain empirical validation.

Scope

The reference is a finite-volume, truncated-basis system: no claim is made about the continuum or infinite-volume spectrum, and none about Yang–Mills. Certification is a threshold test, not a validated bound. Every number in this repository is a property of the two instances computed.