pytorch - 💡(How to fix) Fix Eager fake-tensor execution on symbolic torch.export metadata can specialize shapes and add guards outside tracing

🐛 Describe the bug

Eagerly calling certain ATen ops on fake tensors taken from torch.export(...).graph_module metadata can specialize symbolic shapes to hinted concrete values, mutate the input fake tensor metadata, and add new guards.

The same operation under symbolic tracing preserves symbolic shapes and does not add guards. This issue is reproducible with torch.ops.aten.constant_pad_nd.default, but I do not think it is specific to that op. constant_pad_nd is just a small reproducer.

Reproducer

import torch
from torch.export import Dim, export
from torch.export.exported_program import _get_shape_env
from torch.fx.experimental.proxy_tensor import make_fx

class M(torch.nn.Module):
    def forward(self, x: torch.Tensor) -> torch.Tensor:
        return x + 1


def make_symbolic_fake_input() -> tuple[torch.Tensor, object]:
    ep = export(
        M(),
        (torch.randn(1, 3, 9, 12),),
         dynamic_shapes={
            "x": {
                2: Dim("h", min=2, max=6) * 3,
                3: Dim("w", min=2, max=6) * 3,
            }
        },
    )
    gm = ep.graph_module
    shape_env = _get_shape_env(gm)
    x = next(
        node.meta["val"]
        for node in gm.graph.nodes
        if node.op == "placeholder" and node.name == "x"
    )
    return x, shape_env

def shape_str(t: torch.Tensor) -> str:
    return str(t.shape)


print("=== eager fake-tensor call ===")
eager_x, eager_shape_env = make_symbolic_fake_input()
print("input before:", shape_str(eager_x))
print("guards before:", len(eager_shape_env.guards))

eager_y = torch.ops.aten.constant_pad_nd.default(eager_x, [0, 0, 0, 0], 0.0)

print("input after:", shape_str(eager_x))
print("output after:", shape_str(eager_y))
print("guards after:", len(eager_shape_env.guards))

print()
print("=== symbolic tracing of the same call ===")
traced_x, traced_shape_env = make_symbolic_fake_input()
print("input before:", shape_str(traced_x))
print("guards before:", len(traced_shape_env.guards))

traced = make_fx(
    lambda t: torch.ops.aten.constant_pad_nd.default(t, [0, 0, 0, 0], 0.0),
    tracing_mode="symbolic",
)(traced_x)

print("input after:", shape_str(traced_x))
print("guards after:", len(traced_shape_env.guards))
for node in traced.graph.nodes:
    if "val" in node.meta:
        print(node.name, getattr(node.meta["val"], "shape", None))

Observed output

=== eager fake-tensor call ===
input before: torch.Size([1, 3, 3*s39, 3*s94])
guards before: 2
input after: torch.Size([1, 3, 9, 12])
output after: torch.Size([1, 3, 9, 12])
guards after: 4

=== symbolic tracing of the same call ===
input before: torch.Size([1, 3, 3*s39, 3*s94])
guards before: 2
input after: torch.Size([1, 3, 3*s39, 3*s94])
guards after: 2
t_1 torch.Size([1, 3, 3*s39, 3*s94])
constant_pad_nd torch.Size([1, 3, 3*s39, 3*s94])

Expected behavior

The eager call should not specialize the symbolic dimensions of the input fake tensor or add new guards just from eager fake execution outside tracing, especially for this shape-preserving example.

At minimum, the input fake tensor metadata should remain symbolic.

Notes

• constant_pad_nd is just the smallest repro I found.
• The broader concern is eager fake-tensor execution on symbolic meta["val"] outside tracing, not only this specific op.
• Originally observed in ExecuTorch when eagerly calling a permute_copy during meta["val"] fake-tracing(https://github.com/pytorch/executorch/blob/91aef5732edd2eca416a00f75b38e8e25e6fce52/backends/arm/_passes/rewrite_conv_pass.py#L418)

Versions

Collecting environment information... PyTorch version: 2.11.0.dev20251222+cpu Is debug build: False CUDA used to build PyTorch: None ROCM used to build PyTorch: N/A

OS: Ubuntu 22.04.5 LTS (x86_64) GCC version: (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0 Clang version: 14.0.0-1ubuntu1.1 CMake version: version 3.31.6 Libc version: glibc-2.35

Python version: 3.10.12 (main, Mar 3 2026, 11:56:32) [GCC 11.4.0] (64-bit runtime) Python platform: Linux-6.8.0-52-generic-x86_64-with-glibc2.35 Is CUDA available: False CUDA runtime version: No CUDA CUDA_MODULE_LOADING set to: N/A GPU models and configuration: No CUDA Nvidia driver version: No CUDA cuDNN version: No CUDA Is XPU available: False HIP runtime version: N/A MIOpen runtime version: N/A Is XNNPACK available: True Caching allocator config: N/A

CPU: Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes: 46 bits physical, 48 bits virtual Byte Order: Little Endian CPU(s): 12 On-line CPU(s) list: 0-11 Vendor ID: GenuineIntel Model name: 13th Gen Intel(R) Core(TM) i7-1365U CPU family: 6 Model: 186 Thread(s) per core: 2 Core(s) per socket: 10 Socket(s): 1 Stepping: 3 CPU max MHz: 5200.0000 CPU min MHz: 400.0000 BogoMIPS: 5376.00 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid rdseed adx smap clflushopt clwb intel_pt sha_ni xsaveopt xsavec xgetbv1 xsaves split_lock_detect user_shstk avx_vnni dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp hwp_pkg_req hfi vnmi umip pku ospke waitpkg gfni vaes vpclmulqdq tme rdpid movdiri movdir64b fsrm md_clear serialize pconfig arch_lbr ibt flush_l1d arch_capabilities Virtualization: VT-x L1d cache: 352 KiB (10 instances) L1i cache: 576 KiB (10 instances) L2 cache: 6.5 MiB (4 instances) L3 cache: 12 MiB (1 instance) NUMA node(s): 1 NUMA node0 CPU(s): 0-11 Vulnerability Gather data sampling: Not affected Vulnerability Itlb multihit: Not affected Vulnerability L1tf: Not affected Vulnerability Mds: Not affected Vulnerability Meltdown: Not affected Vulnerability Mmio stale data: Not affected Vulnerability Reg file data sampling: Mitigation; Clear Register File Vulnerability Retbleed: Not affected Vulnerability Spec rstack overflow: Not affected Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; RSB filling; PBRSB-eIBRS SW sequence; BHI BHI_DIS_S Vulnerability Srbds: Not affected Vulnerability Tsx async abort: Not affected

Versions of relevant libraries: [pip3] executorch==1.2.0a0+419e328 [pip3] flake8==6.1.0 [pip3] flake8-breakpoint==1.1.0 [pip3] flake8-bugbear==24.4.26 [pip3] flake8-comprehensions==3.14.0 [pip3] flake8-plugin-utils==1.3.3 [pip3] flake8-pyi==23.5.0 [pip3] mypy==1.14.1 [pip3] mypy-extensions==1.0.0 [pip3] numpy==1.26.4 [pip3] nvidia-cublas-cu12==12.8.3.14 [pip3] nvidia-cuda-cupti-cu12==12.8.57 [pip3] nvidia-cuda-nvrtc-cu12==12.8.61 [pip3] nvidia-cuda-runtime-cu12==12.8.57 [pip3] nvidia-cudnn-cu12==9.7.1.26 [pip3] nvidia-cufft-cu12==11.3.3.41 [pip3] nvidia-curand-cu12==10.3.9.55 [pip3] nvidia-cusolver-cu12==11.7.2.55 [pip3] nvidia-cusparse-cu12==12.5.7.53 [pip3] nvidia-cusparselt-cu12==0.6.3 [pip3] nvidia-nccl-cu12==2.26.2 [pip3] nvidia-nvjitlink-cu12==12.8.61 [pip3] nvidia-nvtx-cu12==12.8.55 [pip3] pytorch_models==0.0.1 [pip3] pytorch_tokenizers==1.0.1 [pip3] slangtorch==1.3.11 [pip3] torch==2.11.0.dev20251222+cpu [pip3] torch-snake==1.0.1 [pip3] torchao==0.16.0+git026b76d12 [pip3] torchaudio==2.10.0.dev20251222+cpu [pip3] torchcodec==0.9.1 [pip3] torchdata==0.11.0 [pip3] torcheval==0.0.7 [pip3] torchmetrics==1.7.0 [pip3] torchsr==1.0.4 [pip3] torchtune==0.0.0 [pip3] torchvision==0.25.0.dev20251222+cpu [pip3] triton==3.3.1 [conda] Could not collect

cc @chauhang @penguinwu @eellison @aorenste @ezyang @bobrenjc93 @aditvenk @laithsakka @bdhirsh