The displayed proof is invalid: its existential-elimination step exports while is still free in that conclusion. This is witness escape. Existential introduction afterwards cannot repair the invalid intermediate step.
Instead introduce the existential while the witness assumption is still open:The existential quantifier introduction rule at line 6 removes the free witness from the exported statement, so the final existential elimination satisfies its eigenvariable condition.
Write . For the first proof, eliminate the common witness before introducing the universal quantifier. Choose fresh and a further fresh arbitrary :At line 5, occurs free in neither nor the witness assumption, so universal introduction is valid. At line 6, is absent from the conclusion and other open assumptions.
For the second proof, reserve arbitrary , eliminate the common witness only as far as the particular existential, close that subproof, and then generalize:At line 5 the exported formula contains no free ; at line 6 the only open assumption contains no free . These different orders of assumption discharge both respect the eigenvariable condition.
The converse is not valid. On the domain , interpret as . Each has a witness , so holds, but no single equals both elements. Thus is false. This is precisely the distinction in quantifier order and uniform witness.
A fresh variable is an arbitrary eigenvariable whose value is not constrained by the undischarged assumptions. For universal introduction, it must not occur free in those assumptions; otherwise a fact about one constrained object could be incorrectly generalized to all objects. For existential elimination, its temporary witness must additionally not occur free in the conclusion or in other undischarged assumptions outside the witness subproof. Choosing a completely unused variable is a sufficient convention. These are the eigenvariable conditions, and concern free occurrences rather than harmless reuse of bound names.
Choose distinct fresh variables . Instantiate the outer universal quantifier first, then the inner one; generalize them in the opposite order.Neither nor occurs free in the sole undischarged premise. Thus both universal introduction steps satisfy the eigenvariable condition.
1. ∀x ∀y P(x,y) premise
2. ∀y P(a,y) ∀E, 1
3. P(a,b) ∀E, 2
4. ∀x P(x,b) ∀I, 3, generalizing a
5. ∀y ∀x P(x,y) ∀I, 4, generalizing bKeep the two existential elimination scopes nested. Let witness the outer existential and the inner one, both fresh. Inside them, negation introduction proves the required counterexample to without invoking an unproved contraposition lemma.The result at lines 12–14 has no free occurrence of either fresh witness. At the inner discharge, is absent from the remaining assumptions; at the outer discharge, is absent from the premise and final conclusion. Hence the eigenvariable conditions hold at both eliminations.
1. ∀x ∀y (P(x,y) → Q(x,y)) premise
2. ∃y ∃x ¬Q(x,y) assumption [i]
3. ∃x ¬Q(x,b) fresh witness assumption [j]
4. ¬Q(a,b) fresh witness assumption [k]
5. ∀y (P(a,y) → Q(a,y)) ∀E, 1
6. P(a,b) → Q(a,b) ∀E, 5
7. P(a,b) assumption [l]
8. Q(a,b) →E, 6, 7
9. ⊥ ¬E, 4, 8
10. ¬P(a,b) ¬I, 7–9, discharging [l]
11. ∃x ¬P(x,b) ∃I, 10
12. ∃y ∃x ¬P(x,y) ∃I, 11
13. ∃y ∃x ¬P(x,y) ∃E, 3, 4–12, discharging [k]
14. ∃y ∃x ¬P(x,y) ∃E, 2, 3–13, discharging [j]
15. (∃y ∃x ¬Q(x,y)) → (∃y ∃x ¬P(x,y))
→I, 2–14, discharging [i]Assume the existential statement and eliminate it using a fresh witness . Let abbreviate . Instantiating its universal quantification at the witness itself gives two incompatible conditional requirements.
1 | ∃x ∀y ((R(x,y) → ¬R(y,y)) ∧ (¬R(y,y) → R(y,y))) assume
2 | | ∀y ((R(u,y) → ¬R(y,y)) ∧ (¬R(y,y) → R(y,y))) fresh witness
3 | | (A → ¬A) ∧ (¬A → A) ∀-elim, 2, y := u
4 | | A → ¬A ∧-elim-L, 3
5 | | ¬A → A ∧-elim-R, 3
6 | | | A assume
7 | | | ¬A →-elim, 6 and 4
8 | | | ⊥ ¬-elim, 6 and 7
9 | | ¬A ¬-intro, discharge 6–8
10 | | A →-elim, 9 and 5
11 | | ⊥ ¬-elim, 10 and 9
12 | ⊥ ∃-elim, 1, subproof 2–11
13 ¬∃x ∀y ((R(x,y) → ¬R(y,y)) ∧ (¬R(y,y) → R(y,y))) ¬-intro, discharge 1–12The contradiction at line 12 contains no free witness variable, so the existential quantifier elimination rule meets its eigenvariable condition. This argument is already valid without classical first-order logic double-negation elimination.
In a finite domain , a true existential premise says that at least one satisfies . The subproof treats its witness as an unknown object named , derives without relying on which object was chosen, and can therefore be applied to the actual witness. Thus follows whenever the existential premise is true. This argument does not require knowing the domain's size or selecting a particular named element in advance.
The existential quantifier elimination rule in sequent form records the same assumption discharge: a derivation of yields . The natural-deduction box represents the temporary witness assumption that the sequent rule replaces by the existential premise.
The eigenvariable condition requires that have no free occurrence in the other undischarged assumptions, the existential premise or the exported conclusion . Bound occurrences can be renamed harmlessly. This freshness condition keeps from denoting a previously special object and prevents witness escape. Without it, one could export from , falsely asserting that an arbitrarily named object has the witness property. A two-element domain with only one element satisfying supplies an immediate counterexample.
The displayed derivation is invalid, although its final conjecture is valid. Its existential-elimination step exports with the local witness name still free, violating the eigenvariable condition. Introducing an existential quantifier afterwards does not repair that earlier invalid rule application.
Move the existential quantifier introduction rule inside the witness scope:
| Line | Formula | Justification |
|---|---|---|
| 1 | Premise | |
| 2 | Premise | |
| 3 | Assume with fresh | |
| 4 | Universal quantifier elimination rule, 1 | |
| 5 | Implication elimination rule, 3 and 4 | |
| 6 | Existential quantifier introduction rule, 5 | |
| 7 | Existential quantifier elimination rule, 2 and 3–6 |
Quantifier order and uniform witness Created 2026-10-25 Updated 2026-10-31
A single witness working for every object supplies a witness for each object individually. Eliminate the outer existential with a fresh witness, instantiate the universal at an arbitrary object, and introduce the required existential. Generalization can occur either before or after closing the witness scope, provided the eigenvariable condition holds in the corresponding contexts. The converse fails on a two-element domain with interpreted as equality: each object has itself as a witness, but no object works for both.
Weakening 2026-10-31
Adding unused assumptions to the context of a logical derivation. The original derivation still proves the same conclusion because it need not use every available assumption. When eigenvariables are used, rename them first if necessary to preserve the eigenvariable condition for any newly added assumptions. This explains how disjunction elimination with different branch contexts can be written using a common context containing all their assumptions.