math-skill 3.1.1 → 3.3.0

package/references/books/abstract-algebra.en.md

@@ -52,41 +52,30 @@ Actual chapter map (grouped by topic; chapter numbers taken from the book's tabl
 
 1. **G-equivariant layer** (source: 5, 6, 10): Implement the symmetry group G's action as permutation/rotation matrices rho(g), with weights shared along orbits, enforcing f(g x)=rho(g) f(x). In practice, for each g in G the input is transformed by rho(g) then passed through the same set of weights, and the results are aggregated -- equivalent to expanding the convolution kernel into a [\|G\|, C_out, C_in] batched GEMM, reducing independent parameters by a factor of \|G\|. Deployed models: CNN (translation), G-CNN (D_n steerable filters), DeepSets/Set Transformer (S_n), E(3)-equivariant GNN (point clouds/molecules).
 2. **Tropical / min-plus attention and routing** (source: 12-14 ring axiom relaxation): Replace softmax's (x,)+exp with (+, min/max) min-plus matmul: score(+) = min_k(Q_ik + K_kj). Hard Top-K routing -> tropical semiring **piecewise-linear gating** (sub-differentiable -- breakpoints need LogSumExp smoothing, which recovers standard softmax; an alternative to the non-differentiable argmax). Viterbi, DTW, and shortest paths are all instances of this min-plus matmul -- see the Tropical Gating example in `../gpu-friendly-math.en.md` (used only for low-dimensional gating and **not on Tensor Cores** -- max/min runs on CUDA cores, while the main trunk still uses standard (x,+) GEMM).
-3. **Permutation-invariant aggregation** (source: 9, 29): Quotienting by the S_n action yields sum/max/mean pooling -- naturally O(n) and parallel-friendly, the algebraic foundation for DeepSets rho(Sigma phi(x_i)) and GNN message passing. Burnside counting (Ch 29) can estimate "how many essentially distinct configurations exist" at design time, for predicting parameter savings and data deduplication benefits.
-4. **Finite-field coding for Infra** (source: 22, 31): Linear codes c=mG (generator matrix G over GF(q)) for fault-tolerant storage and gradient compression, with Hamming distance providing a lower bound on error-correcting capability; Shamir secret sharing (polynomial interpolation over GF(p), recoverable from t shards) for secure aggregation in federated learning; finite-field hashing/CRC for deduplication and consistency verification. Commonality: pure int/bitwise operations, placed in pre/post-processing on data flows.
+3. **Permutation-invariant aggregation** (sources 9, 29): sum/max/mean are permutation invariant. DeepSets' `rho(sum phi(x_i))` has representation results under stated conditions. Burnside's lemma counts orbits of finite group actions exactly; orbit counts become resource estimates only when the sharing or deduplication scheme identifies precisely those orbits.
+4. **Finite-field coding for infrastructure** (sources 22, 31): linear codes `c=mG` support fault-tolerant storage and coded computation, while Hamming distance determines error detection/correction capability. Shamir sharing can be one component of secure aggregation, but privacy also depends on thresholds, dropouts, authentication, and the threat model. CRC detects accidental errors; it is not cryptographic collision resistance.
 5. **Cyclic group representations -> Frequency-domain token mixing** (source: 4, 11): The irreducible representations of Z_n are the DFT basis, giving rise to FFT convolution (O(n log n) replacing O(n^2)), RoPE (encoding positions as SO(2) rotations, i.e., unitary representations of Z), and cyclic/relative positional encodings. The finite abelian group classification theorem (Ch 11) guarantees that any such periodic structure can be decomposed into cyclic components for FFT.
 6. **Fourier / spectral methods on groups** (source: 10 homomorphism + 4/11): Extending the irreducible decomposition of representation theory to general finite groups yields the group convolution theorem -- spectral GNNs and spherical CNNs (harmonic analysis on SO(3)) are special cases; the cost is that fast transforms for non-abelian groups may not exist and complexity must be assessed.
 
 ## GPU Friendliness Warning
 
-> The sole source for eight-dimension criteria and scoring rules: `../gpu-friendly-math.en.md` (Tensorization / GEMM-mappability / Complexity / Memory / Low-precision / Parallelism / Sparsity / Operator fusion). Here we give only per-dimension verdicts for the book's structures.
+> Only implementation questions should use the applicable dimensions in `../gpu-friendly-math.en.md`; an algebraic structure has no universal GPU-friendly/unfriendly label.
 
-**Focus A: Can semiring GEMM run on Tensor Cores? -- Not by default.**
+- **Min/max-plus matrix multiplication:** standard Tensor Core MAC does not natively implement the semiring operations; the naive dense algorithm is O(n^3). Faster possibilities depend on the model and value domain, so compare problem-specific kernels at the target scale.
+- **Numerics and gradients:** max/min avoids exponential overflow, but additions, infinity sentinels, ties, and low-precision comparisons still matter. Max/min is differentiable almost everywhere and admits subgradients; log-sum-exp is a smooth approximation that changes exact semiring semantics, not an equivalent ordinary GEMM.
+- **Group actions:** permutations may use indexing/gather, while larger representations may use dense or sparse operators. Performance depends on shape, reuse, and memory access. Low precision can also drift from exact orthogonal/unitary invariants.
+- **Finite-field arithmetic:** typically uses integer, bitwise, lookup, or dedicated kernels rather than floating-point Tensor Core MAC. It may appear in training-related protocols or coding, but non-differentiable paths must be separated explicitly from gradients.
+- **Avoid explicit enumeration of large groups:** for example, |S_n|=n!. Generators, orbits, or problem-specific parameterizations can help, but preservation of the required equivariance must be proved.
 
-- **D2 GEMM-mappability ([x] unfriendly)**: Tensor Core hardware only performs (x,+) MAC (fp16/bf16/fp8 accumulated into fp32). Min-plus / max-plus uses (+, min/max), which is **not natively supported**; naive tropical GEMM degenerates to CUDA core scalar comparisons and cannot leverage Tensor Cores.
-- **D3 Complexity ([x])**: Min-plus matrix multiplication has no Strassen-style sub-cubic speedup (equivalent to the APSP hard problem); naive O(n^3).
-- **D5 Low-precision ([v])**: Tropical uses max/min, no exp overflow risk; numerically robust.
-- **D8 Differentiability / Operator fusion ([~] adaptable)**: min/max is non-differentiable; requires relaxation.
-- **Adaptations (-> eight-dimension friendly)**: (1) log-sum-exp smoothing of min/max recovers (x,+) stable softmax, back on Tensor Cores; (2) confine tropical operations **to low-dimensional gating only**, keeping the main trunk on standard (x,+) GEMM (the Tropical Gating example in the reference file = D1 [v] Tensorization / D2 [x] not Tensor Core GEMM / D3 [v] per-token gating sub-quadratic, D8 needs LogSumExp smoothing); (3) blocking -- standard GEMM within blocks, min-plus reduction between blocks.
-
-**Focus B: Can group operations be tensorized? -- Small groups yes, large groups and exact arithmetic no.**
-
-- **Finite group actions (D1/D2 [v])**: Permutation matrices / dense representation matrices -> batched GEMM; G-CNN has been engineered. Orthogonal rotation/permutation matrices are numerically stable under bf16 (D5 [v]).
-- **Large group enumeration (D3/D4 [x])**: \|S_n\|=n! explodes; explicitly enumerating group elements -> memory and compute blow up. **Adaptation**: Use only generators (Ch 26 Generators and Relations) + Cayley graphs (Ch 30) for local propagation, without materializing the entire group.
-- **Permutation = gather/scatter (D7/D1/D8 [x])**: Implementation as irregular gather/scatter causes warp divergence. **Adaptation**: Pre-compile fixed permutation patterns into structured sparsity or dense indexing.
-- **Finite fields / modular arithmetic (D2 [x], D1/D6 [v])**: mod p, GF(2^n), XOR, table lookups **are not floating-point MAC** and cannot use Tensor Cores, but are highly parallel on int/bitwise kernels. Conclusion: **suitable for pre/post-processing in coding/hashing, never to be placed in the training main-trunk GEMM**. Galois / exact-field arithmetic requires int, is non-differentiable, violating D8.
-
-**Scoring conclusion**: Group equivariance (small groups, dense representations) and frequency-domain structures = mathematical beauty x GPU friendliness, can enter the main trunk; semirings, finite fields, exact Galois = require relaxation/isolation first, otherwise can only serve as auxiliary operators or offline tools.
-
-**Worked example comparison (candidate x eight-dimension verdict):**
+**Candidate comparison example (benchmark before accepting):**
 
 | Candidate design | Algebraic source (Ch) | Key dimension verdicts | Enter main trunk? |
 |---|---|---|---|
-| Equivariant layer (small groups D_n/S_n, permutation+rotation matrices) | 5, 6, 10 | 1[v] 2[v] 5[v], large groups 3/4[x] | [v] (limited to small groups/generators) |
-| Tropical gating (low-dim min-plus replacing hard Top-K) | 12-14 relaxation | 1[v] 2[v] 8 needs relaxation, main trunk still (x,+) | [v] (gating only) |
-| Pure min-plus main-trunk attention | 12-14 relaxation | 2[x] Tensor Core unsupported, 3[x] O(n^3) | [x] (needs log-sum-exp smoothing first) |
-| Finite-field coding for KV/gradient compression | 22, 31 | 2[x] not floating-point MAC, 1/6[v] int parallel | [x] main trunk / [v] pre/post-processing |
-| Cyclic group representations (FFT/RoPE token mixing) | 4, 11 | 1[v] 2[v] 3[v] (n log n) | [v] |
+| Equivariant layer (finite groups or low-dimensional representations) | 5, 6, 10 | Compare indexed, dense, and sparse implementations; measure equivariance error | Depends on group, representation, and shape |
+| Tropical gating (low-dimensional min/max-plus) | 12-14 | Define tie gradients, complexity, and a kernel | Exploratory; ablate first |
+| Dense min-plus matrix multiplication | 12-14 | Not native Tensor Core MAC; naive O(n^3) | Benchmark only if scale and semantics justify it |
+| Finite-field coding for KV/gradient compression | 22, 31 | Non-floating MAC; coding gain must exceed movement/decode cost | End-to-end benchmark first |
+| Cyclic convolution/FFT; RoPE | 4, 11 | FFT may be O(n log n); RoPE uses elementwise rotations, not the same kernel | Evaluate separately |
 
 ## Which Thinking Lens to Invoke
 
@@ -96,13 +85,13 @@ Actual chapter map (grouped by topic; chapter numbers taken from the book's tabl
 - **Secondary: `duality`** -- homomorphisms/isomorphisms as equivalence transformations, FFT/frequency-domain transforms to simplify problems.
 - **Secondary: `algorithmic`** -- finite group counting (Burnside, Ch 29), coding (Ch 31), finite field enumeration (Ch 22).
 
-Typical combination chain: First `symmetry` to identify the group and invariants in the problem -> `categorical` to extract the common algebraic structure -> `axiomatization` to verify axioms truly hold (guard against false symmetry, guard against misusing subtraction) -> `duality` to realize as a learnable linear map -> finally pass through the `../gpu-friendly-math.en.md` eight-dimension acceptance gate.
+Typical combination chain: use `symmetry` to identify groups and invariants -> `categorical` to extract common algebraic structure -> `axiomatization` to verify the axioms -> `duality` to obtain a learnable representation -> for implementation work, inspect the applicable GPU dimensions and benchmark.
 
 ## Anti-patterns
 
-- **Forcing "group elegance" into the main trunk without Tensor Core support**: tropical / finite-field arithmetic used as GEMM, actually runs as CUDA core scalar throughout.
+- **Treating an algebraic name as a hardware mapping:** tropical or finite-field operations do not become standard Tensor Core GEMM merely because they are written as matrix products; inspect the actual kernel.
 - **Enumerating the entire group** instead of using generators (\|S_n\|=n! / \|GL\| blows memory).
-- **Insisting on exact Galois / finite-field structures**: leads to non-differentiability, requires int, blocks end-to-end gradients.
+- **Failing to isolate exact finite-field paths:** integer/bit operations are not differentiable; a training system must state whether they are outside the gradient path or use an estimator.
 - **Over-constraining with symmetry**: writing "approximately symmetric / pseudo-symmetric" patterns as hard equivariance, stifling expressiveness and model exploration (echoing the agentic-workflow principle of "don't hardcode subjective biases").
 - **Confusing rings with semirings**: assuming additive inverses exist for subtraction/inversion, which fails under min-plus -> correctness errors.
 - **Building a pile of modules for "group elegance"**: when existing equivariant libraries/FFT suffice, don't create new skills; first exhaust existing model capabilities, then add structure (echoing the agentic-workflow principle of "don't create a bunch of skills right away").
@@ -120,5 +109,5 @@ Typical combination chain: First `symmetry` to identify the group and invariants
 - **Ch 22 Finite Fields** -- GF(p^n) construction and arithmetic: the foundation for coding/hashing/secure aggregation.
 - **Ch 29 Symmetry and Counting** -- Burnside counting: estimating equivalence class count / parameter savings.
 - **Ch 31 Introduction to Algebraic Coding Theory** -- Hamming codes, linear codes over finite fields (generator matrix, Hamming distance/weight): compression and fault tolerance.
-- **Ch 32 An Introduction to Galois Theory** -- The symmetry group of field extensions: an exemplar of structured transformations (deployment requires passing the GPU gate first).
+- **Ch 32 An Introduction to Galois Theory** -- symmetry groups of field extensions; an algorithmic use needs an explicit computable representation and task-relevant engineering evaluation.
 - (Semiring relaxation starting point: Ch 12-14 ring axioms -> drop additive inverse -> tropical semiring.)

package/references/books/abstract-algebra.md

@@ -52,41 +52,30 @@
 
 1. **群等变层 G-equivariant layer**（源：5, 6, 10）：把对称群 G 的作用实现为置换/旋转矩阵 ρ(g)，权重沿轨道共享，约束 f(g·x)=ρ(g)·f(x)。实现上对每个 g∈G 把输入用 ρ(g) 变换后过同一组权重，再聚合——相当于把卷积核扩成 [\|G\|, C_out, C_in] 的 batched GEMM，独立参数量 ↓\|G\| 倍。落地模型：CNN（平移）、G-CNN（Dₙ steerable filter）、DeepSets/Set Transformer（Sₙ）、E(3)-等变 GNN（点云/分子）。
 2. **热带 / min-plus 注意力与路由**（源：12–14 环公理松弛）：把 softmax 的 (×,+)+exp 换成 (+, min/max) 的 min-plus matmul：score⊕=min_k(Q_ik+K_kj)。硬 Top-K 路由 → 热带半环**分段线性门控**（次可微——折点需 LogSumExp 软化，软化后退回标准 softmax；替代不可微的 argmax）。Viterbi、DTW、最短路本质都是这条 min-plus matmul——见 `../gpu-friendly-math.md` 的 Tropical Gating 范例（只在低维门控用、且**不上 Tensor Core**——max/min 落 CUDA core，主干仍走标准 (×,+) GEMM）。
-3. **置换不变聚合 permutation-invariant aggregation**（源：9, 29）：对 Sₙ 作用取商即得 sum/max/mean pooling——天然 O(n) 且并行友好，是 DeepSets ρ(Σφ(xᵢ)) 与 GNN message passing 的代数基础。Burnside 计数（29）可在设计期估"本质不同的配置有多少"，用于预测参数节省比与数据去重收益。
-4. **有限域编码做 Infra**（源：22, 31）：线性码 c=mG（生成矩阵 G 在 GF(q) 上）做容错存储与梯度压缩，Hamming 距离给纠错能力下界；Shamir 秘密共享（GF(p) 多项式插值，t 个分片可恢复）做联邦学习安全聚合；有限域哈希/CRC 做去重与一致性校验。共性：纯 int/bitwise，放数据流前后处理。
+3. **置换不变聚合 permutation-invariant aggregation**（源：9, 29）：sum/max/mean 都是置换不变聚合；DeepSets 的 `ρ(Σφ(xᵢ))` 有相应表示定理，但具体条件需另述。Burnside 引理能精确计数有限群作用的轨道；只有参数共享或去重方案确实按这些轨道识别等价对象时，轨道数才可转成资源估计。
+4. **有限域编码做 Infra**（源：22, 31）：线性码 `c=mG` 可用于容错存储或编码计算；Hamming 距离决定可检测/纠正的错误数。Shamir 秘密共享可作为安全聚合协议的组件，但隐私还取决于参与方阈值、掉线、认证和威胁模型。CRC 适合误码检测，不提供密码学抗碰撞性。
 5. **循环群表示 → 频域 token mixing**（源：4, 11）：Zₙ 的不可约表示即 DFT 基，催生 FFT 卷积（O(n log n) 取代 O(n²)）、RoPE（把位置编成 SO(2) 旋转、即 Z 上的酉表示）、循环/相对位置编码。有限阿贝尔群分类定理（11）保证任意此类周期结构都可分解成循环分量做 FFT。
 6. **群上的傅里叶 / 谱方法**（源：10 同态 + 4/11）：把表示论的不可约分解推广到一般有限群，得到群卷积定理——谱 GNN、球面 CNN（SO(3) 上的调和分析）即其特例；代价是非阿贝尔群的快速变换不一定存在，需评估复杂度。
 
 ## GPU 友好性警告
 
-> 八维标准与判分规则唯一来源：`../gpu-friendly-math.md`（张量化 / GEMM 可映射 / 复杂度 / 显存 / 低精度 / 并行 / 稀疏 / 算子融合）。此处只给本书结构的逐维裁决。
+> 仅在实现问题中按 `../gpu-friendly-math.md` 评估相关维度；代数结构本身没有统一的“GPU 友好/不友好”标签。
 
-**焦点 A：半环 GEMM 能上 Tensor Core 吗？——默认不能。**
+- **min/max-plus 矩阵乘**：标准 Tensor Core MAC 不原生支持其半环运算；朴素稠密算法为 O(n³)。是否有更快算法依模型与数值域而定，工程上应与专用 kernel 和问题规模基准比较。
+- **数值与梯度**：max/min 避免指数上溢，但加法、无穷元表示、tie 和低精度比较仍会出问题。max/min 几乎处处可微且可用次梯度；log-sum-exp 是平滑近似，会改变精确半环语义，并不“退回普通 GEMM”等价计算。
+- **群作用**：置换常可用索引/gather，高维表示可用稠密或稀疏算子；哪种更快取决于形状、复用和内存访问。低精度也可能破坏理论上的正交/酉约束，需测不变量漂移。
+- **有限域运算**：通常走整数、位运算、查表或专用 kernel，不使用浮点 Tensor Core MAC；它可出现在训练相关协议或编码中，但不可微部分需要与梯度路径明确隔离。
+- **禁止显式枚举大群**：例如 |Sₙ|=n!；可考虑生成元、轨道或问题特定参数化，但这些替代是否保持所需等变性必须证明。
 
-- **D2 GEMM 可映射（[x]不友好）**：Tensor Core 硬件只做 (×,+) 的 MAC（fp16/bf16/fp8 累加到 fp32）。min-plus / max-plus 用的是 (+, min/max)，**非原生**，朴素 tropical GEMM 退化到 CUDA core 标量比较，吃不到 Tensor Core。
-- **D3 复杂度（[x]）**：min-plus 矩阵乘没有 Strassen 式亚立方加速（等价于 APSP 难题），朴素 O(n³)。
-- **D5 低精度（[v]）**：tropical 用 max/min，无 exp 上溢，反而数值稳健。
-- **D8 可微/融合（[~]可改造）**：min/max 不可微，需松弛。
-- **改造（→ 八维转友好）**：① log-sum-exp 软化 min/max 退回 (×,+) 稳定 softmax，重上 Tensor Core；② 把热带运算**只放在低维门控**，主干仍走标准 (×,+) GEMM（范例文件中 Tropical Gating = D1[v] / D2[x] 非 Tensor Core GEMM / D3[v] 逐 token 门控亚二次，D8 需 LogSumExp 软化）；③ 分块——块内标准 GEMM、块间 min-plus 归约。
-
-**焦点 B：群操作能张量化吗？——小群能，大群和精确算术不能。**
-
-- **有限群作用（D1/D2 [v]）**：置换矩阵 / 稠密表示矩阵 → batched GEMM，G-CNN 已工程化。正交的旋转/置换矩阵在 bf16 下数值稳定（D5 [v]）。
-- **大群枚举（D3/D4 [x]）**：\|Sₙ\|=n! 爆炸，显式枚举群元素 → 显存与算力爆。**改造**：只用生成元（26 Generators and Relations）+ Cayley 图（30）做局部传播，不物化整群。
-- **置换 = gather/scatter（D7/D1/D8 [x]）**：实现为不规则 gather/scatter 会 warp divergence。**改造**：固定置换模式预编译为结构化稀疏或 dense 索引。
-- **有限域 / 模算术（D2 [x]、D1/D6 [v]）**：mod p、GF(2ⁿ)、XOR、查表**不是浮点 MAC**，吃不到 Tensor Core，但在 int/bitwise kernel 上高并行。结论：**适合放编码/哈希的前后处理，绝不放进训练主干 GEMM**。Galois/精确域算术要求 int、不可微，违反 D8。
-
-**判分结论**：群等变（小群、稠密表示）与频域结构 = 数学美 × GPU 友好，可进主干；半环、有限域、精确 Galois = 需先松弛/隔离，否则只能当辅助算子或离线工具。
-
-**范例对照（候选 × 八维裁决）**：
+**候选比较示例（结论须由基准确认）**：
 
 | 候选设计 | 代数来源（章） | 关键维度裁决 | 进主干？ |
 |---|---|---|---|
-| 群等变层（小群 Dₙ/Sₙ，置换+旋转矩阵）| 5, 6, 10 | 1[v] 2[v] 5[v]，群大时 3/4[x] | [v]（限小群/生成元）|
-| 热带门控（低维 min-plus 取代硬 Top-K）| 12–14 松弛 | 1[v] 2[v] 8 需松弛，主干仍 (×,+) | [v]（仅门控）|
-| 纯 min-plus 主干注意力 | 12–14 松弛 | 2[x] Tensor Core 不支持、3[x] O(n³) | [x]（先 log-sum-exp 软化）|
-| 有限域编码压缩 KV/梯度 | 22, 31 | 2[x] 非浮点 MAC，1/6[v] int 并行 | [x]主干 / [v]前后处理 |
-| 循环群表示（FFT/RoPE token mixing）| 4, 11 | 1[v] 2[v] 3[v]（n log n）| [v] |
+| 群等变层（有限群或低维表示）| 5, 6, 10 | 比较索引、稠密与稀疏实现；测等变误差 | 取决于群、表示与形状 |
+| 热带门控（低维 min/max-plus）| 12–14 | 需定义 tie 梯度、复杂度和专用 kernel | 探索性；先消融 |
+| 稠密 min-plus 矩阵乘 | 12–14 | 标准 Tensor Core 不原生支持；朴素 O(n³) | 仅在规模/语义需要时评测 |
+| 有限域编码压缩 KV/梯度 | 22, 31 | 非浮点 MAC；编码收益须覆盖搬运与解码成本 | 先做端到端基准 |
+| 循环卷积/FFT；RoPE | 4, 11 | FFT 可 O(n log n)；RoPE 是逐元素旋转，二者不是同一 kernel | 分别评测 |
 
 ## 该调用哪个思想透镜
 
@@ -96,13 +85,13 @@
 - **副：`duality`**——同态/同构作等价转换、FFT/频域变换简化问题。
 - **副：`algorithmic`**——有限群计数（Burnside, 29）、编码（31）、有限域枚举（22）。
 
-典型组合链：先 `symmetry` 识别问题里的群与不变量 → `categorical` 抽出公共代数结构 → `axiomatization` 核对公理是否真成立（防伪对称、防误用减法）→ `duality` 落成可学习线性映射 → 最后过 `../gpu-friendly-math.md` 八维门。
+典型组合链：先 `symmetry` 识别问题里的群与不变量 → `categorical` 抽出公共代数结构 → `axiomatization` 核对公理是否真成立（防伪对称、防误用减法）→ `duality` 落成可学习表示 → 若涉及实现，再检查相关 GPU 维度并做基准。
 
 ## 反模式
 
-- **把"群之美"硬塞进主干却吃不到 Tensor Core**：tropical / 有限域算术当 GEMM 用，实测全程 CUDA core 标量。
+- **把代数名称当硬件映射**：tropical 或有限域运算不能因写成“矩阵乘”就假定使用标准 Tensor Core GEMM；必须查看实际 kernel。
 - **枚举整群**而非用生成元（\|Sₙ\|=n! / \|GL\| 爆显存）。
-- **死磕精确 Galois / 有限域结构**：导致不可微、必须 int、阻断端到端梯度。
+- **未隔离精确有限域路径**：整数/位运算本身不可微；若它参与训练系统，应明确它是否位于梯度路径之外或使用了何种估计器。
 - **过度对称约束**：把"近似对称/伪对称"写成硬等变，扼杀表达力与模型探索（呼应 agentic-workflow 的"别把主观偏见写死"）。
 - **混淆环与半环**：默认有加法逆元做减法/求逆，到 min-plus 上不成立 → 正确性出错。
 - **为"群之美"造一堆模块**：能用现成等变库/FFT 时不要新造 skill；先用足模型已有能力，再补结构（呼应 agentic-workflow "不要一来就造一堆 skill"）。
@@ -120,5 +109,5 @@
 - **Ch 22 Finite Fields**——GF(pⁿ) 构造与算术：编码/哈希/安全聚合的底座。
 - **Ch 29 Symmetry and Counting**——Burnside 计数：估等价类数 / 参数节省。
 - **Ch 31 Introduction to Algebraic Coding Theory**——Hamming 码、有限域上的线性码（生成矩阵、Hamming 距离/权重）：压缩与容错。
-- **Ch 32 An Introduction to Galois Theory**——域扩张的对称群：结构化变换的范例（落地需先过 GPU 门）。
+- **Ch 32 An Introduction to Galois Theory**——域扩张的对称群；若用于算法设计，须另给可计算表示与任务相关的工程评估。
 - （半环松弛起点：Ch 12–14 环公理 → 去加法逆元 → 热带半环。）

package/references/books/algebraic-geometry-rising-sea.en.md

@@ -145,7 +145,7 @@ First the overview mapping, then detailed expansion:
 
 ## Anti-patterns
 
-- **Putting abstract/derived-functor cohomology directly into the training forward pass**: symbolic computation, gradient-free, not computable -- the classic "beautiful but not computable," violating the GPU eight dimensions. Use Cech + fixed covers with differentiable proxies.
+- **Putting abstract/derived-functor cohomology directly into a training forward pass** usually lacks a direct differentiable and efficient implementation. A Cech complex or fixed cover is only a problem-dependent discrete proxy; its scale complexity, approximation semantics, and empirical value must still be validated.
 - **Introducing the full Scheme/Proj machinery to "look advanced"** when the task only needs a graph Laplacian: over-engineering, violating "Simplicity First." Ask first: "does a trivial sheaf (= standard GNN) suffice?"
 - **Treating Zariski topology / generic points and other discrete structures as differentiable objects** to optimize: type error.
 - **Making Cech covers dynamic with unstructured overlaps**: degenerates into random memory access, destroying GPU parallelism (D7).

package/references/books/algebraic-geometry-rising-sea.md

@@ -113,7 +113,7 @@
 ## GPU 友好性警告
 
 > **必读且唯一权威**：`../gpu-friendly-math.md`
-> 八维记分卡：①张量化 ②GEMM 可映射 ③复杂度 ④显存/KV ⑤低精度稳定 ⑥并行与通信 ⑦稀疏结构 ⑧算子融合。
+> 完整实现审查可考虑张量化、GEMM 映射、复杂度、显存、低精度、并行通信、稀疏和融合；具体候选只展开相关项，其余标 `N/A`。
 > **数学美 ≠ 可算**；任一维"不友好且不可改造"即淘汰。
 
 **可落 GEMM / 亚二次（友好 [v]）：**
@@ -145,7 +145,7 @@
 
 ## 反模式
 
-- **把抽象/导出函子上同调直接塞进训练 forward**：符号计算、无梯度、不可算 —— 经典"美但不可算"，违反 GPU 八维。要用 Čech + 固定覆盖的可微替身。
+- **把抽象/导出函子上同调直接塞进训练 forward**：通常缺少直接可微且高效的实现；Čech 复形或固定覆盖只能作为问题相关的离散代理，仍须给出规模复杂度、近似语义和验证实验，不能默认它既便宜又保持原理论含义。
 - **为"显得高级"引入整套 Scheme/Proj 机械**，而任务其实只需要一个图拉普拉斯：过度工程，违反 CLAUDE.md「Simplicity First」。先问"是否只需平凡层（= 普通 GNN）？"
 - **把 Zariski 拓扑 / generic point 等离散结构当可微对象**优化：类型错误。
 - **让 Čech 覆盖动态化、交叠非结构化**：退化成随机访存，毁掉 GPU 并行（维度⑦）。

package/references/books/applied-cryptography.en.md

@@ -0,0 +1,112 @@
+# Applied Cryptography
+
+> Dan Boneh and Victor Shoup, *A Graduate Course in Applied Cryptography* (v0.4, 2017). A graduate-level reference organized around **attack games and reduction proofs**—a practical guide to constructions, reductions, and protocol analysis.
+
+## Overview
+
+The book treats cryptography as the mathematical study of adversarial systems. Security is defined by a formal **attack game** between a challenger and an adversary: a scheme is secure when no efficient adversary wins with non-negligible advantage. Its proofs are reductions: an attack on scheme Y is transformed into an algorithm for solving hard problem X.
+
+**Activation boundary:** This is a construction-and-proof reference, not an implementation manual. Side channels, constant-time code, and protocol state machines require implementation-focused material as well. Use this distillation to locate security definitions, reduction patterns, and common proof failures.
+
+## Core Structures and Cross-Domain Boundaries
+
+| Cryptographic structure | What transfers—and what does not |
+|---|---|
+| **Attack games (§2)** | Formalize the adversary, interface, and winning event. This discipline can inform ML threat modeling, but cryptographic game names and negligible advantage do not transfer automatically. |
+| **Reduction template (§3)** | “Break my scheme ⇒ solve a hard problem”; makes security relative to explicit assumptions. |
+| **Sequences of games and Difference Lemma (§3.4–3.5)** | Decompose a proof into bounded transitions; the probabilistic form of hybrid reasoning. |
+| **CPA/CCA/AE hierarchy (§4)** | Hierarchy of encryption-oracle capabilities; not equivalent to black-box, white-box, or gradient access in ML. |
+| **PRG/PRF/PRP constructions (§5, §14)** | Constructions and reductions among cryptographic primitives. Similarity to boosting is only structural and does not transfer a proof. |
+| **DDH/CDH/DL assumptions (§6)** | A concrete example of carefully ordering and minimizing assumptions. |
+| **Encrypt-then-MAC composition (§7.9, §9.2)** | Composition does not preserve security automatically; independent keys and context binding matter. |
+| **Sigma protocols and Fiat–Shamir (§11)** | Commitment–challenge–response, underlying Schnorr-style signatures and many noninteractive proof constructions. |
+| **AKE and forward secrecy (§12)** | Formal treatment of session-key security and compromise models. |
+| **Reduction tightness (§10.3)** | If the loss scales with a query factor Q, parameters must compensate for it. |
+
+**Activation families:**
+
+- **Definitions (§2, §4):** attack games, semantic/CPA/CCA security, and authenticated encryption.
+- **Reductions (§3, §16):** black-box wrappers, game sequences, hybrids, and simulation.
+- **Primitives (§5, §14):** OWF, PRG, PRF, PRP, collision-resistant hashing, and trapdoor functions.
+- **Protocols (§9, §11, §12):** public-key encryption, signatures, Sigma protocols, and authenticated key exchange.
+
+## Key Facts
+
+- **Align the advantage convention first (§2.2):** two-experiment differences, `|Pr[b'=b]-1/2|`, and twice that quantity all occur in the literature.
+- **PPT and negligible functions (§2.3):** this is asymptotic language. `poly · negl = negl`, but that does not make an event practically impossible at a fixed parameter.
+- **PRP switching:** for Q queries to an n-bit permutation/function interface, a common bound is on the order of `Q²/2^(n+1)`, subject to the exact advantage convention.
+- **Perfect secrecy:** under the standard finite-space assumptions, Shannon's bound requires `|K| ≥ |M|`.
+- **IND-CPA already permits repeated encryption-oracle queries:** single- and multi-challenge formulations are commonly related by hybrids under matching randomness and message restrictions.
+- **Encrypt-then-MAC has broad composition theorems:** security of MAC-then-encrypt or encrypt-and-MAC depends on the concrete encoding, primitives, and error leakage; neither should be rejected by slogan alone.
+- **Authenticated encryption combines confidentiality and ciphertext integrity:** exact implications depend on the selected games.
+- **Random self-reducibility of discrete logarithm:** an algorithm for random instances can be converted to one for arbitrary instances in the same group setting.
+- **ROM reductions may lose a hash-query factor:** concrete parameters must account for the actual loss.
+- **Quantum threat model:** Shor affects factoring and discrete-log systems; Grover gives a generic square-root query improvement in an ideal black-box model, but concrete quantum resources require separate analysis.
+
+## Suitable Questions
+
+- Write a security game: what can the adversary query, and what counts as winning?
+- Construct a reduction and check whether the simulation is faithful and tight.
+- Review EtM/MtE/EaM composition, key separation, and transcript/identity binding.
+- Convert reduction loss and query limits into concrete parameter requirements.
+- Diagnose protocol failures involving identity binding, downgrade, reflection, nonce reuse, or key reuse.
+- For AI×crypto work, transfer the discipline of explicit adversaries and interfaces; claim a cryptographic reduction only when a security parameter, hard problem, and executable reduction are actually defined.
+
+## Possible Design Inspiration
+
+1. **Adversarial modeling:** use an attack-game structure to specify an ML robustness goal, without inheriting cryptographic guarantees by analogy.
+2. **PRF as a keyed pseudorandom source:** useful for reproducible keyed seeds only under an explicit key-exposure and query model; implementations are normally not GEMMs.
+3. **Sigma protocols to verifiable computation:** proof systems may make a computation independently checkable, but prover and verifier costs depend heavily on the system.
+4. **Reduction discipline for cross-domain security:** ordinary robustness bounds are not cryptographic reductions.
+5. **Commitments for artifact binding:** a commitment can bind a model digest, but does not by itself provide watermark robustness, ownership, or traceability.
+
+## Implementation and GPU Boundary
+
+Pure cryptography does not use the GPU checklist as a security gate. When implementation performance is requested, inspect only the relevant dimensions in `../gpu-friendly-math.en.md`.
+
+- AES and SHA implementations commonly use bit operations, SIMD, CPU ISA extensions, or dedicated GPU kernels. AES-NI and SHA extensions are CPU features; non-GEMM does not mean unaccelerated.
+- RSA and other large-integer arithmetic use bigint kernels rather than ordinary tensor algebra.
+- Elliptic-curve scalar multiplication uses finite-field and point operations, not standard GEMM.
+- SNARK prover/verifier costs vary by system; common kernels include finite-field arithmetic, multiscalar multiplication, pairings, and hashes—not a generic GEMM.
+
+Avoid treating AES/SHA as matrix multiplication, putting cryptographic primitives into a hot training loop without measurement, or using a nondifferentiable cryptographic hash as an ML loss.
+
+## Relevant Thinking Lenses
+
+- **`game`:** attack games, multi-party interaction, and adversarial strategy.
+- **`axiomatization`:** security definitions and explicit assumptions.
+- **`algorithmic`:** a reduction as an algorithm transformation; resource accounting.
+- **`probabilistic`:** advantage, negligible functions, birthday bounds, and hybrids.
+- **`duality`:** information-theoretic vs computational security; adversary vs simulator.
+- **`categorical`:** implication relations among primitives, used carefully as a partial order of constructions.
+
+## Anti-Patterns
+
+- Treating a random-oracle-model proof as an absolute standard-model guarantee.
+- Confusing necessary with sufficient conditions, such as equating key-space size with security.
+- Equating resistance to key recovery with message security.
+- Reusing one key across encryption and MAC without a composition theorem.
+- Claiming deterministic public-key encryption is IND-CPA secure.
+- Reusing IVs or nonces in stream ciphers, CTR, or GCM.
+- Comparing MACs with early-exit code that leaks timing.
+- Ignoring a large reduction loss in a concrete-security claim.
+- Signing an ephemeral key without binding identities and transcript context.
+
+## Deep-Dive Entry
+
+> Dan Boneh and Victor Shoup, *A Graduate Course in Applied Cryptography*, v0.4, September 2017. Online: https://toc.cryptobook.us/
+>
+> Place `Applied Cryptography.pdf` under `math_book/` for targeted local full-text lookup.
+
+Useful chapters:
+
+- **§2:** attack-game framework.
+- **§3:** reductions and sequences of games.
+- **§4:** perfect, semantic, CPA, CCA, and authenticated-encryption notions.
+- **§5:** PRG/PRF/PRP and switching bounds.
+- **§6:** DL/CDH/DDH and random self-reducibility.
+- **§7:** symmetric constructions and composition.
+- **§11:** Sigma protocols and Fiat–Shamir.
+- **§12:** authenticated key exchange, forward secrecy, and PAKE.
+- **§13:** attack patterns and protocol failures.
+- **§16:** reusable reasoning patterns for reductions and games.

package/references/books/applied-cryptography.md

@@ -0,0 +1,127 @@
+# 应用密码学 / Applied Cryptography
+
+> Dan Boneh & Victor Shoup, *A Graduate Course in Applied Cryptography* (v0.4, 2017)。以**攻击游戏 + 归约证明**为统一范式的研究生级应用密码学参考——构造、归约、协议分析的实战手册。
+
+## 概要
+
+本书把密码学定义为"对抗性系统的数学研究"：不是统计可靠性，而是**博弈论式安全证明**。统一组织原则：用形式化**攻击游戏**（challenger vs adversary）定义"安全"，方案安全 ⇔ 不存在高效敌手能以非忽略概率赢游戏。全书定理都是**归约**：破方案 Y ⇒ 解困难假设 X。
+
+**激活边界**：本书是**构造与证明优先**——讲攻击游戏、归约模板、序列游戏、具体安全界，**不是工程实现手册**。落地实现（侧信道、常数时间、协议状态机）需配实现密码学教材（如 Katz-Lindell 的工程章节）。这里给的是"安全定义怎么写、归约怎么构造、哪里会翻车"的**激活索引**。
+
+## 核心结构与跨域边界
+
+| 密码学结构（章节） | 迁移到 AI/ML/系统设计 |
+|---|---|
+| **攻击游戏框架（§2）** | 形式化敌手、接口与胜利事件；可启发 ML 威胁建模，但密码游戏名称和可忽略优势不能直接照搬 |
+| **归约证明模板（§3）** | "破我方案 ⇒ 解困难问题"的通用科学推理；安全性相对化、假设最小化 |
+| **序列游戏 + Difference Lemma（§3.4-3.5）** | 把复杂证明拆成可分析的小步；hybrid argument 的概率版 |
+| **CPA/CCA/AE 层级（§4）** | 加密 oracle 能力的层级；不等同于 ML 中白盒/黑盒/梯度访问 |
+| **PRG/PRF/PRP 构造链（§5, §14）** | 密码原语间的构造与归约；与 boosting 只有高层类比，不能转移证明 |
+| **DDH/CDH/DL 假设族（§6）** | 离散对数族的严格强弱关系；假设最小化原则的实例 |
+| **Encrypt-then-MAC 合成（§7.9, §9.2）** | "合成不保安全"的典型反例；独立密钥、上下文绑定的工程铁律 |
+| **Sigma 协议 + Fiat-Shamir（§11）** | 三步承诺-挑战-响应；NIZK、Schnorr 签名的源头；可迁移到可验证计算 |
+| **AKE 模型 + PFS（§12）** | 会话密钥安全、前向保密；TLS 1.3 的形式化根 |
+| **归约紧度分析（§10.3）** | 安全损失 ε_scheme ≈ Q·ε_assumption；参数选择必须补偿 |
+
+**激活家族**（便于路由检索）：
+
+- **定义系（§2, §4）**：攻击游戏、语义/CPA/CCA 安全、AE——回答"安全到底指什么"。
+- **归约系（§3, §16）**：黑盒 wrapper、序列游戏、hybrid、模拟范式——回答"怎么证明安全"。
+- **原语系（§5, §14）**：OWF/PRG/PRF/PRP/CRHF/TDF——回答"基础工具是什么、怎么叠加"。
+- **协议系（§9, §11, §12）**：PKE、签名、Sigma、AKE——回答"上层协议如何组装"。
+
+## 关键桥接事实（激活速记）
+
+- **优势 convention 需先对齐**（§2.2）：双实验差、$|\Pr[b'=b]-1/2|$ 及其两倍都常见；倍数关系取决于定义。
+- **PPT + 忽略函数**（§2.3）：这是渐近安全语言；$\mathrm{poly}\cdot\mathrm{negl}=\mathrm{negl}$，但不自动代表固定参数下“实际不可能”。
+- **PRP Switching Lemma：Q 次查询区分 n-bit PRP 与随机函数优势 ≤ Q²/2^{n+1}**（§5.4）：AES 当 PRF 用只要查询数有界。
+- **Shannon 完美保密 ⇒ |K| ≥ |M|**（§4.1）：信息论安全的代价——密钥不得短于消息（OTP 的根源）。
+- **IND-CPA 已允许多次 encryption-oracle 查询**（§4.3）：单挑战与多挑战版本通常可经 hybrid 等价，但需满足相同随机性与消息限制，不能按“对称/公钥”一句话切开。
+- **EtM 有宽泛的通用合成定理**（§7.9）：MtE/EaM 的安全依赖具体编码、原语与错误泄露，不能无条件判不安全。
+- **AE 同时要求机密性与密文完整性**（§4.4-4.5）：常见定义可推出相应 CCA 机密性；精确蕴含取决于采用的游戏。
+- **DL 随机自归约**（§6.6）：DL 在随机实例上可解 ⇒ 任意实例可解，"全难或全易"。
+- **归约紧度 ε_RSA ≈ ε_sig / q_H**（§10.3）：ROM 归约常松，需参数补偿。
+- **量子威胁**（§14.3）：Shor 破坏大整数分解/离散对数类方案；Grover 给理想黑盒穷举平方加速，但具体资源评估不能只用“安全位减半”。
+
+## 适合激活的问题类型
+
+- **安全定义书写**：怎么把"敌手能做什么、赢是什么"形式化？哪个层级（CPA/CCA/AE）贴现需求？避免"直觉上安全"的空话。
+- **归约证明设计**：如何构造 B（攻击假设 X）把 A（攻击方案 Y）当黑盒？模拟是否完美？紧度损失多少？
+- **协议合成审查**：EtM/MtE/EaM 哪个能过？密钥是否独立？上下文（身份/转录）是否绑进 MAC？
+- **参数选择**：归约紧度 ε_scheme ≈ Q·ε_assumption，Q 多大？需多少额外 bit 补偿？量子下要多少？
+- **协议级失败诊断**：身份缺失、反射、降级、nonce 重用——根因在"上下文未绑定"还是"密钥复用"？
+- **AI×密码交叉**：仅迁移“明确敌手、接口、胜利条件”的定义纪律；若声称归约，还必须给安全参数、困难问题与可执行 reduction。
+
+## 可能的算法启发
+
+> 密码学本身不直接产 GPU kernel，但其**设计思想**可迁移到 AI 安全/可验证计算：
+
+1. **对抗性建模迁移**：攻击游戏框架用于 ML 鲁棒性证明——定义敌手能力预算 → 定义"破" → 证不可破。*落点：方法论，不直接落 GPU。*
+2. **PRF 作为带密钥伪随机源**：可生成可复现 seed；不可预测性只在明确密钥泄露与查询模型下成立，且实现通常不是 GEMM。
+3. **Sigma 协议 → 可验证计算**：让 AI 推理产出 SNARK 式证明，验证者低成本核对。*落点：D3——验证端廉价、证明端昂贵。*
+4. **归约范式用于交叉安全**：只有能构造正式 reduction 时才给“相对安全”结论；普通鲁棒性界不是密码学归约。
+5. **承诺用于工件绑定**：可绑定已承诺的模型摘要，但不自动给水印鲁棒性、所有权或可追踪性。
+
+## GPU 友好性警告
+
+> 纯密码任务不以 GPU 清单作为安全验收门。只有用户要求实现或性能分析时，才评估 `../gpu-friendly-math.md` 中相关的计算维度；多数原语使用 CPU、GPU 专用内核或其他硬件路径：
+
+**天然不友好但可专用硬件加速：**
+- **AES/SHA via SIMD/ASIC**：AES-NI、SHA-NI 是 CPU 指令；GPU 有不同的批量 kernel。非 GEMM 不等于不可加速，D1/D2 对密码实现通常不适用。
+- **大数模乘/RSA**：bigint 运算，非张量化。*违反 D1/D2/D3。*
+- **椭圆曲线标量乘**：有限域算术与点运算通常非 GEMM；D2 对纯密码任务为 `N/A`。
+
+**方法论层面友好：**
+- **攻击游戏/归约模板**：纯逻辑推理，不涉及 GPU。
+- **PRF 作为 seed 生成**：一次性小开销，不构成瓶颈。
+- **可验证计算（SNARK）**：证明/验证成本依证明系统而异，常见核心是有限域、椭圆曲线 MSM/配对或哈希，不应概括为 GEMM。
+
+**反模式警告：**
+- 把 AES/SHA 当 GEMM 算子去优化——南辕北辙。
+- 在训练循环里频繁调用密码学原语——非张量化、拖垮 SM 占用。
+- 用密码学哈希做 ML loss——哈希不可导，无法反传。
+
+## 该调用哪个思想透镜
+
+配合 `../../lenses/` 下的思想透镜：
+
+- **`game`（博弈）**：攻击游戏、多方策略互动、机制设计——本书的灵魂。
+- **`axiomatization`（公理化）**：安全定义即公理——假设的相容性、独立性、完备性。
+- **`algorithmic`（算法）**：归约即算法变换；复杂度可行性、并行性。
+- **`probabilistic`（概率统计）**：忽略函数、优势、birthday 攻击、hybrid argument。
+- **`duality`（对偶）**：信息论 vs 计算安全；模拟范式（敌手视角 ↔ 模拟器视角）。
+- **`categorical`（范畴化）**：原语间的蕴含关系形成偏序（OWF⇒PRG⇒PRF⇒...）。
+
+## 反模式
+
+- **把 ROM 证明当绝对保证**：ROM 是启发式，存在反例；instantiation 可能不安全。
+- **混淆必要与充分条件**：大密钥空间必要非充分（代换密码 26!≈2^88 但可破）。
+- **假设"密钥难恢复=方案安全"**：Enc_k(m)=m 密钥无法恢复但零安全。
+- **加密与 MAC 共用密钥**：EtM 要求独立密钥，否则跨原语交互致破。
+- **确定性加密当 CPA 安全**：公钥场景下确定性必破（加密-比对攻击）。
+- **IV/nonce 重用**：stream cipher/CTR/GCM 中重用即灾难（两时间本 XOR 泄露）。
+- **非常数时间比较 MAC**：`memcmp` 短路泄露前缀，时序攻击可伪造。
+- **归约松仍称安全**：ε_scheme ≈ Q·ε_assumption 时 Q 大则实际安全远低于声称。
+- **协议签名只签临时密钥不绑身份**：身份误绑攻击。
+- **堆定理而不诊断瓶颈**：先问"安全目标是 CPA/CCA/AE 哪层、归约目标是什么假设"，再选工具。
+
+## 深挖入口
+
+> **书目信息**：Dan Boneh & Victor Shoup, *A Graduate Course in Applied Cryptography*, v0.4, Sep 2017. 在线：https://toc.cryptobook.us/
+>
+> **启用方式**：将 `Applied Cryptography.pdf` 放入 `math_book/`，Agent 自动 `pdftotext` + grep 定位原文页。
+
+值得深读的真实章节：
+
+> 以下章节号对应原书 Boneh-Shoup v0.4 实际目录（非精简版自编），用于 `math_book/` PDF 回查定位。
+
+- **§2 Attack Game Framework**——所有安全定义的统一模板。
+- **§3 Reduction Proof Pattern + Sequence-of-Games**——归约与游戏跳跃的实战。
+- **§4 Security Hierarchy**（perfect→semantic→CPA→CCA→AE）——威胁模型层级。
+- **§5 PRG/PRF/PRP + Switching Lemma**——对称原语与替换界。
+- **§6 DL/CDH/DDH + Random Self-Reducibility**——数论假设族。
+- **§7 Symmetric Constructions**（stream/CTR/CBC/MAC/Merkle-Damgård/sponge/EtM）——构造工具箱。
+- **§11 Sigma Protocols + Fiat-Shamir**——零知识与签名转换。
+- **§12 AKE + PFS + PAKE**——协议安全的形式化。
+- **§13 Attack Patterns**（两时间本/延展性/padding oracle/extension/related-key/nonce 误用/协议级失败）——反模式总集。
+- **§16 Reasoning Patterns**（归约心态/模拟范式/理想替换/游戏跳跃/hybrid/必要条件/合成/"无暗门"原则）——可迁移思维模式。

package/references/books/differential-geometry.md

@@ -74,7 +74,7 @@
 
 ## GPU 友好性警告
 
-> 用 `../gpu-friendly-math.md` 的**八维记分卡**逐项评判。微分几何最大的坑是"度量 / 曲率矩阵的求逆与物化"。
+> 用 `../gpu-friendly-math.md` 评判相关实现维度，无关项标 `N/A`。微分几何实现常见风险是度量/曲率矩阵的求逆、物化与条件数。
 
 - **D2/D3**：求逆是生死线。 朴素自然梯度要算 N×N Fisher 的逆，N 是参数量（~10⁹），O(N³) 求逆 + O(N²) 显存，**直接出局**。
   - **可改造 [v]**：**K-FAC** 把 F 分块为 Kronecker 积 A⊗B，利用 (A⊗B)⁻¹ = A⁻¹⊗B⁻¹，只需对两个小因子求逆，且预条件作用到梯度上**就是 GEMM**。这就是"能否 Kronecker 因子化为 GEMM"的肯定答案——能，且这是它唯一可上集群的形态。

package/references/books/foundations-of-cryptography.en.md

@@ -0,0 +1,112 @@
+# Foundations of Cryptography
+
+> Oded Goldreich, *Foundations of Cryptography, Volume 1: Basic Tools*, Cambridge University Press, 2001. A theoretical foundation unified by **definition methodology and constructive reductions**.
+
+## Overview
+
+The book's central contribution is methodological: it replaces informal security intuition with explicit definitions, computational assumptions, and reductions. Classical efficient adversaries are commonly modeled as probabilistic polynomial-time algorithms, but PPT is a modeling convention—not the set of every practical attack. Quantum computation, nonuniform circuits, side channels, and concrete resources require additional models.
+
+Good cryptographic definitions formalize the intended intuition, exclude trivial constructions, permit constructions, and support reductions. The book develops implication and construction relations among primitives such as OWFs, PRGs, and PRFs.
+
+**Activation boundary:** This is a theory-and-meta-theorem reference, not a deployment manual. Many generic constructions establish existence but are too inefficient for practice. Use it for definitions, assumption dependencies, reductions, and impossibility boundaries; use implementation references for concrete systems.
+
+## Core Structures and Cross-Domain Boundaries
+
+| Theoretical structure | What transfers—and what does not |
+|---|---|
+| **Computational indistinguishability (§2.2)** | Defines “cannot be distinguished” relative to efficient distinguishers. It is not statistical closeness; an ML transfer must redefine the security parameter, distinguisher class, and sampling interface. |
+| **PPT and negligible functions (§2.1, §2.3)** | An asymptotic quantifier framework; deployment also needs explicit time, query, and success bounds. |
+| **OWF/PRG/PRF construction chain (Parts III, V)** | Deep existence and construction relations under standard definitions; not a proof of an ML boosting result. |
+| **Cryptographic reductions (§4.1)** | The reduction must preserve the adversary's input and success distribution; arbitrary distribution substitution invalidates the proof. |
+| **Hybrid arguments (§4.2)** | Bound a long transition by analyzable adjacent steps. The number of hybrids and each transition bound matter. |
+| **Weak-to-strong amplification (§4.3)** | Strengthens cryptographic properties while tracking loss; only a high-level analogy to boosting. |
+| **Simulation paradigm (§4.4, Part VI)** | Defines zero knowledge in a stated real/ideal experiment. The mere existence of an informal simulator does not imply training-data privacy or differential privacy. |
+| **Unpredictability and pseudorandomness (§4.5)** | Yao's next-bit characterization concerns binary distribution ensembles, efficient predictors, and a security parameter—not ordinary next-token uncertainty. |
+| **Goldreich–Levin hardcore bit (§5.1)** | Constructs a computationally unpredictable predicate from an OWF; it is not information-theoretically perfectly hidden. |
+| **Black-box vs non-black-box (§7.3)** | Classifies constructions and separation results; a black-box impossibility need not rule out non-black-box techniques. |
+
+**Activation families:**
+
+- **Definitions:** OWF, PRG, PRF, zero knowledge, and commitments.
+- **Proof techniques:** reductions, hybrids, amplification, simulation, and unpredictability.
+- **Constructions:** OWF → hardcore predicate → PRG → PRF → commitments and zero knowledge.
+- **Meta-theory:** definition-driven research, primitive implication relations, black-box separations, and assumption minimization.
+
+## Key Facts
+
+- **Computational indistinguishability does not imply statistical closeness:** pseudorandom ensembles may have much smaller support than the uniform distribution while remaining computationally indistinguishable.
+- **Multi-sample lifting needs sampling assumptions:** for efficiently and independently sampled ensembles, a hybrid can lift one-sample indistinguishability to polynomially many samples.
+- **OWF existence and PRG existence are equivalent under standard formulations:** the HILL theorem supplies the difficult direction.
+- **Weak OWFs can be amplified:** a parallel construction is simple to state, but the inversion proof cannot assume independent adversarial success events.
+- **Yao's next-bit characterization:** a distinguisher for an output ensemble can be converted into a predictor for some next bit with a loss related to the output length.
+- **Goldreich–Levin:** for `g(x,r)=(f(x),r)`, the inner-product predicate `<x,r> mod 2` is hardcore under the stated OWF setting.
+- **GGM tree:** input bits select a path through repeated PRG expansion; evaluation computes one leaf on demand rather than storing an exponential function table.
+- **Zero knowledge is simulation with precise quantifiers:** the verifier class, auxiliary input, running time, and perfect/statistical/computational relation must be stated.
+- **Zero-knowledge class containments depend on definitions and assumptions:** do not compress conditional results about interactive proofs into an unconditional equality chain.
+
+## Suitable Questions
+
+- How should security, privacy, or unlearnability be formalized?
+- Does primitive A imply primitive B, and is the reduction black-box?
+- Which assumption is minimal, and can it be weakened to an OWF assumption?
+- How is a weak property amplified without an unjustified independence step?
+- What simulator and quantifier order are required by the claimed real/ideal guarantee?
+- Does a next-bit analogy define an encoding, ensemble, security parameter, and efficient predictor? Natural-language next-token metrics normally do not satisfy the theorem's premises.
+- Where is the boundary between computational privacy, information-theoretic leakage, and differential privacy?
+
+## Possible Design Inspiration
+
+1. **Goldreich–Levin as a construction lesson:** an ordinary hard-to-optimize ML mapping is not automatically an OWF.
+2. **GGM-style keyed expansion:** can inspire compact keyed generation or routing, but any pseudorandomness claim still needs the cryptographic interface and assumption.
+3. **Hybrid reasoning for drift analysis:** decompose a multi-step distribution change, while proving rather than assuming each transition bound.
+4. **Simulation for real/ideal definitions:** useful for structuring privacy claims, but it implies only the stated simulation notion and not DP automatically.
+5. **Weak-to-strong only as structural analogy:** cryptographic amplification and PAC boosting have different premises and conclusions.
+
+## Implementation and GPU Boundary
+
+The book primarily supplies definitions, theorems, and reductions—not GPU kernels.
+
+- Generic HILL/GGM constructions are chiefly existence results and are not default practical implementations.
+- Generic zero-knowledge constructions for NP may have large constants and round/prover costs; practical systems use specialized constructions with their own assumptions.
+- The Leftover Hash Lemma is an information-theoretic extraction tool; efficiency depends on the entropy parameters and hash family.
+- Reduction, hybrid, and simulation reasoning has no GPU acceptance requirement.
+- Goldreich–Levin is related to Hadamard/list-decoding structure, but that does not make an ML deployment automatically useful.
+
+Avoid implementing a generic existence construction as a production primitive, treating computational indistinguishability as a differentiable loss, or treating a classical PPT adversary as a quantum/side-channel model. Quantum security usually requires a QPT adversary and an explicit oracle-access model.
+
+## Relevant Thinking Lenses
+
+- **`axiomatization`:** definitions, consistency, independence, and explicit assumptions.
+- **`categorical`:** implication relations among primitives, without overclaiming universal properties.
+- **`algorithmic`:** reductions as algorithms; black-box vs non-black-box access.
+- **`probabilistic`:** negligible functions, indistinguishability, hybrids, and birthday bounds.
+- **`duality`:** information-theoretic vs computational security; adversary vs simulator.
+- **`perturbation`:** tracking losses in amplification.
+- **`local-to-global`:** adjacent hybrids to a whole chain; one sample to many under sampling assumptions.
+
+## Anti-Patterns
+
+- Treating a definition as a construction.
+- Assuming independent inversion events inside an amplification proof.
+- Applying a black-box separation result to every non-black-box construction.
+- Treating asymptotic security as a concrete fixed-parameter bound.
+- Equating honest-verifier zero knowledge with zero knowledge against arbitrary malicious verifiers.
+- Reusing the classical PPT model for quantum, side-channel, or nonuniform attackers without revision.
+- Citing meta-theorems before identifying the exact assumption and quantifier order.
+
+## Deep-Dive Entry
+
+> Oded Goldreich, *Foundations of Cryptography, Volume 1: Basic Tools*, Cambridge University Press, 2001. ISBN 978-0-521-79235-9.
+>
+> Place `Foundations of Cryptography.pdf` under `math_book/` for targeted local full-text lookup.
+
+Useful sections:
+
+- **§2.1–2.4:** probability and computational indistinguishability.
+- **§2.5–2.6:** strong and weak one-way functions.
+- **§3:** pseudorandom generators and hardcore predicates.
+- **§4:** reductions, hybrids, amplification, simulation, and unpredictability.
+- **§5:** pseudorandom functions and the GGM tree.
+- **§6:** simulation and zero knowledge for NP.
+- **§7:** definition methodology and black-box/non-black-box results.
+- **§9:** assumptions and limitations.