math-skill 3.2.0 → 3.3.0

package/knowledge-base/algebraic-geometry/sheaf-cohomology.en.md

@@ -0,0 +1,72 @@
+# Sheaf Cohomology
+
+## Minimal Definition
+A sheaf $\mathcal{F}$ assigns an algebraic structure (group/ring/vector space) $\mathcal{F}(U)$ to each open set $U$ of a topological space, subject to local-to-global gluing rules. Concretely:
+- **Local sections**: $\mathcal{F}(U)$ is the set of "local solutions" on $U$
+- **Sheaf axiom (gluing)**: if $\{U_i\}$ is an open cover of $U$ and $s_i\in\mathcal{F}(U_i)$ agree on overlaps $U_i\cap U_j$, then there exists a unique $s\in\mathcal{F}(U)$ restricting to each $s_i$
+
+Sheaf cohomology $H^i(X,\mathcal{F})$ measures local-to-global obstructions finer than the section-gluing axiom itself — for example extension classes, principal-bundle classification, or higher gluing problems. The first cohomology $H^1$ is the most commonly used obstruction diagnostic; Čech cohomology, computed via the intersection complex of an open cover, is the most commonly used approximate form in engineering.
+
+## Core Formulas
+- **Sheaf condition (gluing axiom)**: $\mathcal{F}(U)\to\prod_i\mathcal{F}(U_i)\rightrightarrows\prod_{i,j}\mathcal{F}(U_i\cap U_j)$ is an equalizer
+- **Čech complex**: $C^p(\mathcal{U},\mathcal{F})=\prod_{i_0<\cdots<i_p}\mathcal{F}(U_{i_0\cdots i_p})$, differential $d^p:C^p\to C^{p+1}$ formed from restriction maps
+- **Cohomology groups**: $H^i(X,\mathcal{F})=\ker d^i/\mathsf{im}\,d^{i-1}$
+- **Meaning of $H^1=0$**: For many extension, principal-bundle, or gluing-obstruction problems, $H^1$ measures whether local data can be lifted to a global object. Note: a true sheaf already guarantees by the gluing axiom that “sections agreeing on overlaps ⇒ a unique global section,” so $H^1=0$ must not be stated as a blanket necessary-and-sufficient condition for arbitrary “local consistency ⇒ global consistency.” Engineering diagnoses should first specify which cohomology problem is being measured.
+- **Spectral sequence (Leray)**: $E_2^{p,q}=H^p(\mathcal{U},\mathcal{H}^q)$ converges to $H^{p+q}(X,\mathcal{F})$, computing higher cohomology
+- **Relation to de Rham cohomology**: $H^i_{\mathsf{dR}}(X)\cong H^i(X,\Omega_X^{\bullet})$, de Rham cohomology is a special case of sheaf cohomology
+- **Vanishing theorems** (Cartan Theorem A/B, Serre): on affine varieties, coherent sheaf cohomology $H^i=0$ for $i>0$; on projective space, line bundle $\mathcal{O}(d)$ has $H^i$ vanishing for certain $d$ ranges
+
+## Applicable Problems
+- Diagnosing "locally consistent but globally obstructed" structures:
+  - **Multi-view feature alignment**: each view locally aligns, but global alignment fails — $H^1$ measures the alignment obstruction
+  - **Multi-modal fusion inconsistency**: each modality's local information is consistent, but global fusion has contradictions
+  - **Distributed training global consistency**: each node's local gradients agree, but global aggregation has obstructions
+  - **Topological obstructions in representation space**: "holes" or "loops" in feature space affect downstream tasks
+- Model diagnosis: detecting structural obstructions in representation spaces (nontrivial $H^1$)
+- Knowledge graph reasoning: local consistency of entity relations vs global contradictions
+
+## AI Design Translation
+- **Sheaf cohomology as a "local-to-global obstruction diagnostician"**: model multi-view / multi-modal / multi-node local consistency as sheaf sections, with $H^1$ as a formal measure of fusion failure
+- **H¹ as a multi-view fusion consistency measure**: define a sheaf on multi-view features, compute Čech cohomology, $H^1=0$ means fusable, $H^1\ne 0$ means obstructed
+- **Persistent sheaf cohomology**: combine persistent homology with sheaf cohomology as a topological diagnostic for representation spaces
+- See `../../design-patterns/compression/topology-preserving-compression.en.md`, `../../design-patterns/representation/shared-private-decomposition.en.md` for corresponding patterns; if no match, label as "temporary design translation."
+
+## Engineering Feasibility
+Sheaf cohomology has severe GPU-friendliness challenges:
+- **D1[x]**: exact Čech cohomology requires constructing open covers + computing high-order intersection complexes, non-tensorizable
+- **D2[x]**: boundary matrix reduction is highly serial, not GEMM-mappable
+- **D3[x]**: exact Čech cohomology starts at $O(N^3)$, $N$ being the open-cover size; higher cohomology $O(N^{p+3})$
+- **D4[~]**: can be reduced to landmark sampling $O(m^3)$, $m\ll N$; but still not GPU-friendly
+- **D5[v]**: integer arithmetic (boundary matrices) has no precision issues; floating-point approximations can use bf16
+- **D6[x]**: reduction algorithms are highly serial; landmark selection can be parallelized
+- **D7[~]**: sparse boundary matrices can be stored in CSR; SpMM is effective but reduction remains serial
+- **D8[x]**: boundary matrix reduction is not fusable
+**Key retrofit**: use landmark sampling $O(m^3)$ instead of full $O(N^3)$; use approximate persistent homology versions; use Euler curves as proxies; **exact cohomology should not be inserted into training loops**, only as diagnostics or regularization.
+
+## Risks and Failure Conditions
+- **Exact cohomology is uncomputable**: $O(N^3)$ serial algorithms are infeasible for $N>10^4$; approximations are mandatory
+- **Čech approximation depends on cover choice**: open-cover selection affects results; different covers give different $H^i$; landmark selection may introduce bias
+- **Wrong sheaf parameterization distorts cohomology**: if the sheaf $\mathcal{F}$'s sections are defined incorrectly, $H^i$ loses diagnostic meaning
+- **$H^1=0$ does not guarantee higher-order obstruction-free**: $H^1=0$ only guarantees local solutions can be glued globally, but $H^2$ and above may still be obstructed
+- **Euler curve information loss**: $\chi=\sum(-1)^k\beta_k$ compresses multiple orders into a single value; different topologies can share the same $\chi$
+- **Topology ≠ semantics**: topological preservation is not semantic preservation; two semantically different spaces may be topologically isomorphic
+- **Cohomology base-field sensitivity**: $\mathbb{Z}$ coefficients vs $\mathbb{R}$ vs $\mathbb{F}_p$ give different torsion information
+
+## Further References
+- Distilled notes: `../../references/books/algebraic-geometry-rising-sea.en.md`
+- Original book: Ravi Vakil, *The Rising Sea: Foundations of Algebraic Geometry*, Ch 18-22 (sheaves and cohomology)
+- Original book: Robin Hartshorne, *Algebraic Geometry*, Ch III (Cohomology)
+
+## Routing Extensions
+- If local-to-global is needed → `../../lenses/local-to-global.en.md` (assembling local properties into global)
+- If topological diagnosis is needed → `../topology/persistent-homology.en.md` (persistent homology, Betti numbers)
+- If categorical language is needed → `../../lenses/categorical.en.md` (sheaves are a core categorical construct)
+- If Euler characteristic is needed → `../topology/euler-characteristic.en.md` (fast topological diagnostic proxy)
+
+## Extensible Directions
+- Derived functors: $\mathsf{Ext}^i$, $\mathsf{Tor}_i$ as derived functors
+- Spectral sequences: Leray, Grothendieck, Atiyah-Hirzebruch
+- Hodge decomposition: cohomology of algebraic varieties over $\mathbb{C}$
+- D-modules: differential operator theory on sheaves
+- Picard group: isomorphism classes of line bundles, $H^1(X,\mathcal{O}^{\times})$
+- Persistent sheaf cohomology: combining persistent homology with sheaf cohomology

package/knowledge-base/algebraic-geometry/sheaf-cohomology.md

@@ -0,0 +1,72 @@
+# 层上同调 / Sheaf Cohomology
+
+## 最小定义
+层 $\mathcal{F}$ 是给拓扑空间每个开集 $U$ 赋一个代数结构（群/环/向量空间）$\mathcal{F}(U)$ 并满足局部到整体粘合规则的对象。具体地：
+- **局部截面**：$\mathcal{F}(U)$ 是 $U$ 上的"局部解"集合
+- **粘合公理（sheaf axiom）**：若 $\{U_i\}$ 是 $U$ 的开覆盖，且 $s_i\in\mathcal{F}(U_i)$ 在交叠 $U_i\cap U_j$ 上一致，则存在唯一 $s\in\mathcal{F}(U)$ 限制到每个 $U_i$ 为 $s_i$
+
+层上同调 $H^i(X,\mathcal{F})$ 度量比“截面粘合公理”更细的局部到整体障碍——例如扩张类、主丛分类或高阶粘合问题。一阶上同调 $H^1$ 是最常用的障碍诊断量；Čech 上同调用开覆盖的交并复形计算，是工程上最常用的近似形式。
+
+## 核心公式
+- **层条件**（粘合公理）：$\mathcal{F}(U)\to\prod_i\mathcal{F}(U_i)\rightrightarrows\prod_{i,j}\mathcal{F}(U_i\cap U_j)$ 是等化子
+- **Čech 复形**：$C^p(\mathcal{U},\mathcal{F})=\prod_{i_0<\cdots<i_p}\mathcal{F}(U_{i_0\cdots i_p})$，微分 $d^p:C^p\to C^{p+1}$ 由限制映射构成
+- **上同调群**：$H^i(X,\mathcal{F})=\ker d^i/\mathsf{im}\,d^{i-1}$
+- **$H^1=0$ 的含义**：对许多扩张、主丛或粘合障碍问题，$H^1$ 刻画局部数据能否升成全局对象。注意：真层本身已由粘合公理保证“交叠一致的截面 ⇒ 唯一全局截面”，因此不能把 $H^1=0$ 笼统写成任意“局部一致 ⇒ 全局一致”的充要条件；工程诊断应先写清所测障碍对应哪一类上同调问题。
+- **谱序列（Leray）**：$E_2^{p,q}=H^p(\mathcal{U},\mathcal{H}^q)$ 收敛到 $H^{p+q}(X,\mathcal{F})$，计算高阶上同调
+- **与 de Rham 上同调关系**：$H^i_{\mathsf{dR}}(X)\cong H^i(X,\Omega_X^{\bullet})$，de Rham 上同调是层上同调的特例
+- **消失定理**（Cartan Theorem A/B、Serre）：仿射簇上凝聚层的 $H^i=0$（$i>0$）；投影空间上线丛 $\mathcal{O}(d)$ 的 $H^i$ 在某些 $d$ 范围消失
+
+## 适用问题
+- 诊断"局部数据一致但全局存在障碍"的结构：
+  - **多视图特征对齐**：各视图局部对齐一致，但全局对齐失败——$H^1$ 度量对齐障碍
+  - **多模态融合不一致性**：各模态局部信息一致，全局融合存在矛盾
+  - **分布式训练的全局一致性**：各节点局部梯度一致，但全局聚合存在障碍
+  - **表示空间中的拓扑障碍**：特征空间的"洞"或"环"影响下游任务
+- 模型诊断：检测表示空间是否存在结构性障碍（非平凡 $H^1$）
+- 知识图谱推理：实体关系的局部一致 vs 全局矛盾
+
+## AI 设计翻译
+- **层上同调作为"局部到整体障碍诊断器"**：把多视图 / 多模态 / 多节点局部一致性建模为层截面，$H^1$ 作为融合失败的形式化度量
+- **H¹ 作为多视图融合一致性度量**：对多视图特征定义层，计算 Čech 上同调，$H^1=0$ 表示可融合，$H^1\ne 0$ 表示存在障碍
+- **持续层上同调（persistent sheaf cohomology）**：结合持续同调与层上同调，作为表示空间的拓扑诊断
+- 对应设计模式见 `../../design-patterns/compression/topology-preserving-compression.md`、`../../design-patterns/representation/shared-private-decomposition.md`；无对应模式时标为"临时设计翻译"。
+
+## 工程可行性
+层上同调 GPU 友好度挑战很大：
+- **D1[x]**：精确 Čech 上同调需要构造开覆盖 + 计算高阶交并复形，非张量化
+- **D2[x]**：边界矩阵约化高度串行，不可 GEMM 化
+- **D3[x]**：精确 Čech 上同调 $O(N^3)$ 起步，$N$ 为开覆盖规模；高阶上同调 $O(N^{p+3})$
+- **D4[~]**：可降维到 landmark 采样 $O(m^3)$，$m\ll N$；但仍非 GPU 友好
+- **D5[v]**：整数运算（边界矩阵）无精度问题；浮点近似可 bf16
+- **D6[x]**：约化算法高度串行；landmark 选择可并行
+- **D7[~]**：稀疏边界矩阵可 CSR 存储；SpMM 有效但约化仍串行
+- **D8[x]**：边界矩阵约化不可融合
+**关键改造**：用 landmark 采样 $O(m^3)$ 替代全量 $O(N^3)$；用持续同调的近似版本；用 Euler curve 作代理；**精确同调不应塞进训练循环**，只作为诊断或正则项。
+
+## 风险与失效条件
+- **精确同调不可算**：$O(N^3)$ 串行算法在 $N>10^4$ 时不可行，必须依赖近似
+- **Čech 近似依赖覆盖选择**：开覆盖的选取影响结果，不同覆盖给出不同 $H^i$；landmark 选择可能引入偏差
+- **层结构错误参数化导致上同调失真**：若层 $\mathcal{F}$ 的截面定义错误，$H^i$ 失去诊断意义
+- **$H^1=0$ 不保证高阶无障碍**：$H^1=0$ 只保证局部解可全局粘合，但 $H^2$ 及以上可能有障碍
+- **Euler curve 信息退化**：$\chi=\sum(-1)^k\beta_k$ 把多阶压成单值，不同拓扑可共享同一 $\chi$
+- **拓扑 ≠ 语义**：拓扑保持不等于语义保持；两个语义不同的空间可能拓扑同构
+- **上同调基域选择敏感**：$\mathbb{Z}$ 系数 vs $\mathbb{R}$ 系数 vs $\mathbb{F}_p$ 系数给出不同的 torsion 信息
+
+## 深入参考
+- 蒸馏稿：`../../references/books/algebraic-geometry-rising-sea.md`
+- 原书：Ravi Vakil, *The Rising Sea: Foundations of Algebraic Geometry*, Ch 18-22（层与上同调）
+- 原书：Robin Hartshorne, *Algebraic Geometry*, Ch III（Cohomology）
+
+## 路由扩展
+- 若需要局部到整体 → `../../lenses/local-to-global.md`（局部性质拼接为全局）
+- 若需要拓扑诊断 → `../topology/persistent-homology.md`（持续同调、Betti 数）
+- 若需要范畴论语言 → `../../lenses/categorical.md`（层是范畴论的核心构造）
+- 若需要欧拉示性数 → `../topology/euler-characteristic.md`（快速拓扑诊断代理）
+
+## 可扩展方向
+- 导出函子（derived functors）：$\mathsf{Ext}^i$、$\mathsf{Tor}_i$ 作为导出函子
+- 谱序列（spectral sequences）：Leray、Grothendieck、Atiyah-Hirzebruch
+- Hodge 分解（Hodge decomposition）：$\mathbb{C}$ 上的代数簇上同调分解
+- D-模（D-modules）：层上的微分算子理论
+- 皮卡群（Picard group）：线丛的同构类群，$H^1(X,\mathcal{O}^{\times})$
+- 持续层上同调（persistent sheaf cohomology）：持续同调与层上同调的结合

package/knowledge-base/cryptography/attack-game-framework.en.md

@@ -0,0 +1,56 @@
+# Attack-Game Framework
+
+## Minimal Definition
+
+An attack game is a probabilistic interaction between a challenger and an adversary that specifies a security goal, adversarial capabilities, and a winning event. Security usually means that every adversary within the stated resource class has negligible asymptotic advantage or an explicitly small concrete advantage.
+
+An encryption indistinguishability game is only one instance. Signatures, MACs, commitments, and zero knowledge use different oracles, restrictions, and winning conditions; they cannot all be forced into one “submit two messages and guess a bit” script.
+
+## Core Formulas
+
+- Two-experiment advantage:
+  $$\operatorname{Adv}_A=\left|\Pr[A\text{ outputs }1\text{ in experiment }0]-\Pr[A\text{ outputs }1\text{ in experiment }1]\right|.$$
+- Bit-guess games commonly use $|\Pr[b'=b]-1/2|$ or twice this quantity. Align conventions before comparing bounds.
+- Difference lemma: if two games can diverge only after event `bad`,
+  $$|\Pr[W_0]-\Pr[W_1]|\le \Pr[\mathsf{bad}].$$
+- For $q$ uniform $n$-bit samples, the collision union bound is $q(q-1)/2^{n+1}$; $q^2/2^n$ is only an order-level shorthand.
+
+## Applicable Problems
+
+- Formalize IND-CPA/CCA, EUF-CMA, PRF, binding/hiding, and related properties.
+- Specify encryption, decryption, signing, verification, random-oracle, or leakage interfaces.
+- Check post-challenge restrictions, freshness, multi-user effects, and adaptive corruption.
+- Rewrite a proof as a game sequence and track advantage loss at each transition.
+
+## Cryptographic Construction and Cross-Domain Boundary
+
+- AI security can borrow the discipline of explicitly defining the adversary, interface, budget, and winning event. It must not simply rename CPA/CCA as black-box/white-box attacks.
+- Perturbation sets, data distributions, and error rates in ML are generally not negligible functions. Use task-appropriate risks or certified radii rather than mechanically requiring $\operatorname{negl}(n)$.
+- Load cryptographic oracle details only when the AI construction actually uses a primitive or claims a cryptographic property.
+
+## Implementation Considerations
+
+- A game is a definition. Finite tests can find implementation deviations but cannot prove negligible advantage against every PPT adversary.
+- Concrete-security reports should state the security parameter, queries, time/memory, user count, and all failure events.
+- Randomness, state reset, challenge freshness, and forbidden-query logic must match between implementation and proof.
+
+## Risks and Failure Conditions
+
+- **Weak adversary model:** Missing interfaces, leakage, or adaptivity proves security in the wrong game.
+- **Mixed advantage conventions:** $|p-1/2|$ and $2|p-1/2|$ differ by a factor of two.
+- **Asymptotic/concrete confusion:** Negligibility does not itself establish sufficient strength at fixed parameters.
+- **Incorrect challenge restrictions:** Too little restriction trivializes the game; too much inflates security.
+- **Testing as proof:** Failure to find an attack is evidence only against the tested adversaries.
+
+## Further References
+
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/foundations-of-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## Routing Extensions
+
+- Reductions: `reduction-proof-template.en.md`
+- CPA/CCA/AE: `cca-cpa-ae-hierarchy.en.md`
+- PRF: `prf-prg-owf.en.md`
+- Probability bounds: `../probability/concentration-inequality.en.md`

package/knowledge-base/cryptography/attack-game-framework.md

@@ -0,0 +1,56 @@
+# 攻击游戏框架 / Attack-Game Framework
+
+## 最小定义
+
+攻击游戏是挑战者与敌手之间的概率交互实验，用来精确定义安全目标、敌手能力和胜利事件。方案安全通常表示：对所有给定资源界内的敌手，其优势可忽略（渐近安全）或小于明确数值（具体安全）。
+
+加密的 indistinguishability game 只是一个实例；签名、MAC、承诺和零知识各有不同 oracle、限制与胜利条件，不能统一套用“提交两条消息、猜 bit”的固定流程。
+
+## 核心公式
+
+- 双实验优势：
+  $$\operatorname{Adv}_A=\left|\Pr[A\text{ 在实验 }0\text{ 输出 }1]-\Pr[A\text{ 在实验 }1\text{ 输出 }1]\right|.$$
+- 猜 bit 游戏常用 $\left|\Pr[b'=b]-\tfrac12\right|$ 或其两倍。比较论文时必须先对齐 convention。
+- 序列游戏/Difference Lemma：若两游戏只在事件 `bad` 后可能分歧，则
+  $$\left|\Pr[W_0]-\Pr[W_1]\right|\le \Pr[\mathsf{bad}].$$
+- $q$ 个均匀 $n$-bit 样本发生碰撞的 union bound 为 $q(q-1)/2^{n+1}$；“$q^2/2^n$”只是量级写法。
+
+## 适用问题
+
+- 为 IND-CPA/CCA、EUF-CMA、PRF、binding/hiding 等性质写正式游戏。
+- 比较敌手是否拥有加密、解密、签名、验证、随机预言机或状态泄露接口。
+- 检查挑战后的禁止查询、freshness、multi-user、adaptive corruption 等细节。
+- 将证明改写成游戏序列并跟踪每一步优势损失。
+
+## 密码学构造与跨域边界
+
+- 游戏框架可以迁移到 AI 安全定义，但只能迁移“显式写敌手、接口、预算和胜利事件”的方法，不能把 CPA/CCA 名称直接重命名为黑盒/白盒攻击。
+- ML 鲁棒性中的扰动集、数据分布和错误率一般不是可忽略函数；应使用与任务匹配的风险或认证半径，而非机械要求 $\operatorname{negl}(n)$。
+- 只有当 AI 方案实际调用密码学原语或声称密码学安全性质时，才加载本卡的密码学 oracle 细节。
+
+## 实现注意事项
+
+- 游戏是定义；测试代码只能发现实现偏差，不能以有限样本证明所有 PPT 敌手优势可忽略。
+- 具体安全报告应列出安全参数、查询数、时间/内存资源、多用户数和所有失败事件。
+- 随机数、状态重置、challenge freshness 和禁止查询条件必须在实现与证明中一致。
+
+## 风险与失效条件
+
+- **敌手模型过弱**：遗漏接口、泄露或自适应能力会得到“在错误游戏里安全”的结论。
+- **优势 convention 混用**：$|p-1/2|$ 与 $2|p-1/2|$ 相差 2，可能破坏具体参数计算。
+- **渐近与具体安全混淆**：可忽略函数并不自动说明固定参数下足够安全。
+- **挑战限制漏写**：允许直接查询挑战对象会使游戏平凡；限制过强又会人为抬高安全性。
+- **把经验攻击失败当证明**：未找到攻击只给出对已测试敌手的证据。
+
+## 深入参考
+
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/foundations-of-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## 路由扩展
+
+- 归约：`reduction-proof-template.md`
+- CPA/CCA/AE：`cca-cpa-ae-hierarchy.md`
+- PRF：`prf-prg-owf.md`
+- 概率界：`../probability/concentration-inequality.md`

package/knowledge-base/cryptography/cca-cpa-ae-hierarchy.en.md

@@ -0,0 +1,57 @@
+# Encryption Security Hierarchy: CPA, CCA, and AE
+
+## Minimal Definition
+
+- **IND-CPA:** Even with encryption-oracle access, an adversary cannot distinguish the challenge encryptions of two equal-length messages.
+- **IND-CCA1:** A decryption oracle is available before, but not after, the challenge.
+- **IND-CCA2:** A decryption oracle is available before and after the challenge, except on the challenge ciphertext itself and any variants excluded by the definition.
+- **INT-CTXT:** The adversary cannot produce a fresh valid ciphertext not previously returned by the encryption oracle.
+- **Authenticated encryption (AE):** Provides confidentiality and ciphertext integrity. A common formulation uses IND-CPA + INT-CTXT and implies the corresponding CCA confidentiality; exact AE/AEAD games vary by source.
+
+This is a common hierarchy, not a claim that IND-CCA2 is the strongest possible notion for every protocol.
+
+## Core Formulas
+
+- IND advantage is written as $|\Pr[b'=b]-1/2|$ or twice this quantity, depending on convention.
+- Typical implications: IND-CCA2 $\Rightarrow$ IND-CCA1 $\Rightarrow$ IND-CPA; converses fail in general.
+- With independent keys and suitable primitive assumptions, Encrypt-then-MAC (EtM) is a generic route to AE.
+- MAC-then-Encrypt and Encrypt-and-MAC are **not unconditionally insecure**. They lack EtM's broad generic composition theorem; security depends on the encryption/MAC, encoding, error handling, and leakage model.
+- For perfect secrecy over finite message spaces, the key space/entropy must cover the message uncertainty; in the common uniform finite case $|\mathcal K|\ge|\mathcal M|$. This is not a general key-length formula for computational security.
+
+## Applicable Problems
+
+- Select confidentiality and integrity goals for encryption, KEM-DEM, record, or storage protocols.
+- Determine whether decryption oracles, errors, and replay interfaces strengthen the adversary.
+- Review EtM/AEAD key separation, nonce handling, and associated-data binding.
+- Check whether a paper's CPA/CCA/AE claim matches its actual API.
+
+## Cryptographic Construction and Cross-Domain Boundary
+
+- CPA/CCA describe encryption-oracle capabilities; they are not synonyms for black-box/white-box/gradient access in ML.
+- Correctness, unforgeability, and privacy are distinct. Verifiable inference should define soundness, zero knowledge/privacy, and authentication separately rather than calling all of them AE.
+- EtM cannot be transferred to an arbitrary ML pipeline merely as “verify before/after inference.” First define the authenticated bytes, parsing behavior, and failure side channels.
+
+## Implementation Considerations
+
+- Prefer standardized AEAD APIs. Meet each scheme's random/unique nonce requirement and bind protocol context as associated data.
+- Derive separate encryption and authentication keys; verify the tag before releasing plaintext and unify error behavior.
+- CCA security does not itself prevent replay, traffic analysis, endpoint compromise, or side channels.
+
+## Risks and Failure Conditions
+
+- **Treating implication as equivalence:** IND-CPA does not imply IND-CCA; confidentiality does not imply integrity.
+- **Judging composition from initials alone:** MtE/EaM security depends on the concrete construction.
+- **Nonce/key reuse:** Many AEAD schemes lose confidentiality and integrity under nonce reuse.
+- **Decryption error side channels:** Distinct padding/tag/parsing failures can become an oracle.
+- **Invalid perfect-secrecy analogy:** $|\mathcal K|\ge|\mathcal M|$ does not mean training-data size must exceed model-parameter count.
+
+## Further References
+
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## Routing Extensions
+
+- Games: `attack-game-framework.en.md`
+- Reductions: `reduction-proof-template.en.md`
+- PRF: `prf-prg-owf.en.md`

package/knowledge-base/cryptography/cca-cpa-ae-hierarchy.md

@@ -0,0 +1,57 @@
+# 加密安全层级：CPA、CCA 与 AE
+
+## 最小定义
+
+- **IND-CPA**：敌手可获得加密 oracle，并不能区分两条等长消息的挑战密文。
+- **IND-CCA1**：挑战前可查询解密 oracle，挑战后不可。
+- **IND-CCA2**：挑战前后均可查询解密 oracle，但禁止提交挑战密文本身（及定义规定的等价变体）。
+- **INT-CTXT**：敌手不能产生未由加密 oracle 返回过、但能通过解密验证的新密文。
+- **认证加密（AE）**：同时提供机密性与密文完整性。常见形式化采用 IND-CPA + INT-CTXT，并可推出相应的 CCA 机密性；不同文献的 AE/AEAD 游戏需对齐。
+
+这是常用层级，不表示 IND-CCA2 是所有协议场景中“最强可能”的安全定义。
+
+## 核心公式
+
+- IND 优势按采用的 convention 写为 $|\Pr[b'=b]-1/2|$ 或其两倍。
+- 典型蕴含：IND-CCA2 $\Rightarrow$ IND-CCA1 $\Rightarrow$ IND-CPA；逆向一般不成立。
+- 在独立密钥和合适原语假设下，Encrypt-then-MAC（EtM）是构造 AE 的通用方法。
+- MAC-then-Encrypt 和 Encrypt-and-MAC **不是无条件不安全**；它们缺少与 EtM 同样宽泛的通用合成定理，具体安全性取决于加密/MAC、编码、错误处理和泄露模型。
+- 对有限消息空间的完美保密，密钥空间/熵必须足以覆盖消息不确定性；常见均匀有限情形给出 $|\mathcal K|\ge|\mathcal M|$。这不是计算安全方案的一般密钥长度公式。
+
+## 适用问题
+
+- 为加密、KEM-DEM、记录层或存储协议选择机密性与完整性目标。
+- 检查解密 oracle、错误信息和重放接口是否升级了敌手能力。
+- 审查 EtM/AEAD 的 key separation、nonce 和 associated data 绑定。
+- 判断论文声称的 CPA/CCA/AE 是否与实际 API 一致。
+
+## 密码学构造与跨域边界
+
+- CPA/CCA 描述的是加密 oracle 能力，不等同于 ML 的黑盒/白盒/梯度访问层级。
+- “输出正确”“不可伪造”“保密”是不同性质；可验证推理若需要密码学保证，应分别定义 soundness、zero knowledge/privacy 和 authentication，而不是统称 AE。
+- EtM 的经验不能按“先校验后推理/先推理后校验”的文字顺序直接迁移到任意 ML pipeline；必须先定义被认证的字节串、解析行为与失败侧信道。
+
+## 实现注意事项
+
+- 优先使用标准 AEAD API，保证 nonce 按方案要求唯一或随机，并把协议上下文绑定为 associated data。
+- 独立派生加密与认证密钥；验证 tag 后再释放明文，错误路径保持统一。
+- CCA 安全不自动解决重放、流量分析、端点泄露或侧信道，需要协议层机制。
+
+## 风险与失效条件
+
+- **把蕴含当等价**：IND-CPA 不能推出 IND-CCA；机密性也不能推出完整性。
+- **无条件评价组合顺序**：MtE/EaM 的结论依赖具体构造，不能只按缩写判安全或不安全。
+- **nonce/密钥复用**：很多 AEAD 在 nonce 重复时同时失去机密性和完整性。
+- **解密错误侧信道**：padding/tag/解析错误差异可形成 oracle。
+- **完美保密类比误用**：$|\mathcal K|\ge|\mathcal M|$ 不能映射成“训练数据量 ≥ 模型参数量”。
+
+## 深入参考
+
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## 路由扩展
+
+- 攻击游戏：`attack-game-framework.md`
+- 归约：`reduction-proof-template.md`
+- PRF：`prf-prg-owf.md`

package/knowledge-base/cryptography/index.en.md

@@ -0,0 +1,54 @@
+# Cryptography Activation Index
+
+## Domain Signals
+Activate this domain when the problem involves:
+- Security definitions: formal threat models like CPA/CCA1/CCA2/AE/EUF-CMA
+- Primitives: OWF/PRG/PRF/PRP/CRHF/TDF and their equivalence / construction chains
+- Assumptions: DL/CDH/DDH/RSA/LWE/quantum threats (Shor/Grover)
+- Reduction proofs: black-box reductions, hybrid argument, simulation paradigm, tightness analysis
+- Protocols: encryption/MAC/signature/ZK/AKE/MPC
+- Attack games: formal challenger-vs-adversary interaction framework
+- Post-quantum: lattice-based, code-based, hash-based signatures
+- Advanced constructions: homomorphic encryption, attribute-based encryption, functional encryption, verifiable computation
+
+## Core Anchors
+- `prf-prg-owf.en.md` — Pseudorandom function families, pseudorandom generators, and one-way functions (minimal-assumption → basic-primitive equivalence chain)
+- `reduction-proof-template.en.md` — Reduction proof template (constructive "break-scheme ⇒ solve-assumption" reasoning paradigm)
+- `attack-game-framework.en.md` — Attack game framework (challenger-vs-adversary security definition paradigm)
+- `cca-cpa-ae-hierarchy.en.md` — Security hierarchy CPA/CCA/AE (increasing adversary capability layers)
+
+## Extension Concepts
+When core anchors are insufficient, these concepts may require temporary activation:
+- Zero-knowledge proofs: interactive/non-interactive (Fiat-Shamir), Sigma protocols, zk-SNARK/zk-STARK
+- Commitment schemes: hiding + binding, hash commitments, Pedersen commitments
+- Secret sharing: Shamir threshold and verifiable secret sharing
+- Homomorphic encryption: partial/leveled/fully homomorphic schemes; BFV/BGV/CKKS/TFHE and bootstrapping
+- Multi-party computation (MPC): Yao garbled circuits, GMW, BGW, SPDZ
+- Verifiable computation (VC): PCP, zk-SNARK, GKR, interactive proofs
+- Differential privacy × cryptography intersection: indistinguishability on adjacent datasets, relation to computational indistinguishability
+- Post-quantum cryptography (PQC): lattice-based (LWE/RLWE), code-based (McEliece), hash-based (SPHINCS+), multivariate
+- Identity-based cryptography (IBE): master key derivation, Boneh-Franklin
+- Attribute-based encryption (ABE): key-policy vs ciphertext-policy, access structures
+- Functional encryption (FE): function keys for decryption
+- Impossibility & separation results: black-box separation, Oracle separation, meta-theorems
+
+## Reference Book Directions
+- `../../references/books/applied-cryptography.md`: Boneh & Shoup, attack games + reduction proofs + constructions and protocols
+- `../../references/books/foundations-of-cryptography.md`: Goldreich, definitional methodology + constructive reductions + meta-theorems
+- `../../references/books/introduction-to-modern-cryptography.md`: Katz & Lindell, formal security definitions + construction paradigms + implementation pitfalls
+
+## AI×Crypto Boundary
+Load cross-domain material only when a task combines an AI object with a formal cryptographic property:
+- A PRF supplies keyed reproducible pseudorandomness; protection of routing or watermarking depends on the leakage and query game.
+- Commitments, signatures, or MACs can authenticate model artifacts; they do not prove semantic correctness of the model.
+- Zero knowledge/verifiable computation proves an encoded circuit relation; separately prove that the circuit faithfully represents the intended inference.
+- Differential privacy is a statistical privacy definition, not a hardness assumption. When combined with cryptographic protocols, track $(\varepsilon,\delta)$ separately from computational security parameters.
+- Attack-game discipline can specify an ML adversary and winning event, but CPA/CCA cannot simply be renamed as black-box/white-box access.
+- Ordinary hashing, robustness bounds, or simulator analogies do not create cryptographic security.
+
+## Temporary Activation Rules
+When the required mathematics is not in core anchors:
+1. First check the extension concepts list for a match
+2. If matched, generate a temporary knowledge card using relevant lenses (game/axiomatization/algorithmic/probabilistic/duality/causal/categorical)
+3. If unmatched, enter Knowledge Gap Protocol
+4. Tag the temporary card's domain as "crypto" or "shared" for subsequent upgrade

package/knowledge-base/cryptography/index.md

@@ -0,0 +1,54 @@
+# 密码学 激活索引 / Cryptography Activation Index
+
+## 领域信号
+当问题涉及以下信号时，激活本领域方向：
+- 安全定义：CPA/CCA1/CCA2/AE/EUF-CMA 等威胁模型的形式化
+- 原语：OWF/PRG/PRF/PRP/CRHF/TDF 及其等价与构造链
+- 假设：DL/CDH/DDH/RSA/LWE/量子威胁（Shor/Grover）
+- 归约证明：黑盒归约、hybrid argument、模拟范式、紧度分析
+- 协议：加密/MAC/签名/零知识/AKE/多方安全计算
+- 攻击游戏：challenger vs adversary 的形式化交互框架
+- 后量子：格密码、编码密码、哈希签名
+- 高级构造：同态加密、属性基加密、函数加密、可验证计算
+
+## 核心锚点
+- `prf-prg-owf.md` — 伪随机函数族、伪随机生成器与单向函数（最小假设→基本原语等价链）
+- `reduction-proof-template.md` — 归约证明模板（"破方案⇒解假设"的构造性推理范式）
+- `attack-game-framework.md` — 攻击游戏框架（challenger vs adversary 的安全定义范式）
+- `cca-cpa-ae-hierarchy.md` — 安全层级 CPA/CCA/AE（威胁模型能力递增层级）
+
+## 扩展概念
+当核心锚点不够时，以下概念可能需要临时激活：
+- 零知识证明：交互式/非交互式（Fiat-Shamir）、Sigma 协议、zk-SNARK/zk-STARK
+- 承诺方案：隐藏性 + 绑定性、哈希承诺、Pedersen 承诺
+- 秘密共享：Shamir 门限、可验证秘密共享
+- 同态加密：部分/层级/全同态；BFV/BGV/CKKS/TFHE 与自举（bootstrapping）
+- 多方安全计算（MPC）：Yao 混淆电路、GMW、BGW、SPDZ
+- 可验证计算（VC）：PCP、zk-SNARK、GKR、interactive proofs
+- 差分隐私与密码学交集：对相邻数据集的不可区分性、与计算不可区分的关系
+- 后量子密码学（PQC）：格基密码（LWE/RLWE）、编码基（McEliece）、哈希基（SPHINCS+）、多变量密码
+- 基于身份的密码学（IBE）：主密钥派生、Boneh-Franklin
+- 属性基加密（ABE）：密钥策略 vs 密文策略、访问结构
+- 函数加密（FE）：带函数密钥的加密
+- 不可能性与分离结果：黑盒分离、Oracle 分离、meta-theorem
+
+## 参考书方向
+- `../../references/books/applied-cryptography.md`：Boneh & Shoup，攻击游戏 + 归约证明 + 构造与协议
+- `../../references/books/foundations-of-cryptography.md`：Goldreich，定义方法论 + 归约可构造性 + 元定理
+- `../../references/books/introduction-to-modern-cryptography.md`：Katz & Lindell，形式化安全定义 + 构造范式 + 实现陷阱
+
+## AI×密码交叉边界
+仅在问题同时包含 AI 对象与形式化密码性质时加载交叉内容：
+- PRF 可提供带密钥、可复现的伪随机性；能否保护路由/水印取决于密钥泄露与查询游戏。
+- 承诺、签名或 MAC 可认证模型工件；它们不会自动证明模型语义正确。
+- 零知识/可验证计算可证明某个已编码电路关系；还需单独证明该电路忠实表示目标推理。
+- 差分隐私是统计隐私定义，不是“困难假设”；与密码协议组合时分别跟踪 $(\varepsilon,\delta)$ 与计算安全参数。
+- 攻击游戏的方法可用于写清 ML 敌手和胜利事件，但 CPA/CCA 名称不能直接改名为黑盒/白盒攻击。
+- 普通哈希、鲁棒性界或模拟器类比不足以产生密码学安全结论。
+
+## 临时激活规则
+当问题需要的数学不在核心锚点中时：
+1. 先检查扩展概念中是否有匹配
+2. 若有，根据透镜（game/axiomatization/algorithmic/probabilistic/duality/causal/categorical）生成临时知识卡
+3. 若无，进入 Knowledge Gap Protocol
+4. 临时卡标注 domain 为 "crypto" 或 "shared"，便于后续升级

package/knowledge-base/cryptography/prf-prg-owf.en.md

@@ -0,0 +1,62 @@
+# One-Way Functions, Pseudorandom Generators, and Pseudorandom Functions
+
+## Minimal Definition
+
+- **One-way function (OWF):** Efficiently computable, while every probabilistic polynomial-time (PPT) algorithm finds any preimage of the image of a random input with only negligible probability.
+- **Pseudorandom generator (PRG):** A deterministic polynomial-time map $G:\{0,1\}^n\to\{0,1\}^{\ell(n)}$, $\ell(n)>n$, such that $G(U_n)$ and $U_{\ell(n)}$ are computationally indistinguishable to every PPT distinguisher.
+- **Pseudorandom function family (PRF):** An efficient keyed family $F_k:\mathcal X\to\mathcal Y$ whose oracle is computationally indistinguishable from a uniformly sampled random function $\mathcal X\to\mathcal Y$ for every PPT oracle distinguisher.
+
+These are asymptotic definitions for families indexed by a growing security parameter, not unconditional claims about one fixed-parameter implementation.
+
+## Core Formulas
+
+- OWF: for every PPT $A$,
+  $$\Pr_{x\leftarrow U_n}\left[f(A(1^n,f(x)))=f(x)\right]\le \operatorname{negl}(n).$$
+- PRG advantage:
+  $$\operatorname{Adv}^{\rm prg}_{G}(D)=\left|\Pr[D(G(U_n))=1]-\Pr[D(U_{\ell(n)}))=1]\right|.$$
+- PRF advantage:
+  $$\operatorname{Adv}^{\rm prf}_{F}(A)=\left|\Pr_{k}[A^{F_k}=1]-\Pr_{R}[A^{R}=1]\right|.$$
+- Existence relations: OWFs exist iff PRGs exist; GGM constructs a PRF from a PRG. A PRF yields a PRP through Feistel: the classical Luby--Rackoff results give a PRP against forward queries with three rounds and a strong PRP against forward and inverse queries with four rounds, with concrete bounds depending on query count and block length.
+- PRP/random-function switching bounds have birthday order $O(q^2/2^n)$. Exact constants depend on the game and inverse-query access, so there is no context-free unique formula.
+
+## Applicable Problems
+
+- Decide whether a keyed construction satisfies the PRF definition and write its real/random oracle game.
+- Analyze GGM-like constructions or PRF-based encryption/MAC constructions through hybrids.
+- Separate standard-model existence theorems, primitive-based reductions, and concrete assumptions that treat AES/HMAC as PRFs.
+- Account for birthday loss, key/domain separation, and multi-user security.
+
+## Cryptographic Construction and Cross-Domain Boundary
+
+- Practical systems normally use analyzed candidates or standardized constructions such as HMAC, CMAC/KMAC, or block-cipher-based modes, rather than directly implementing generic HILL/GGM existence constructions.
+- In AI×crypto tasks, a PRF can provide keyed reproducible pseudorandomness, but only relative to a stated oracle and leakage model. Parameters, gradients, logs, or distributed training may reveal key-related information outside the original game.
+- An OWF does not automatically make hashed features private; input distributions, auxiliary information, collisions, and membership inference need separate models.
+- Yao's next-bit characterization concerns binary distribution ensembles and efficient predictors. Without defining encoding, conditional distributions, and a security parameter, it does not imply “hard next-token prediction makes an entire language-model output pseudorandom.”
+
+## Implementation Considerations
+
+- PRFs are normally implemented with bit operations, permutations, hash/compression functions, or dedicated cryptographic instructions, not “small GEMMs.” AES-NI and SHA-NI are CPU ISA features and are not evidence of GPU feasibility.
+- Nonces, counters, domain tags, and derived subkeys must satisfy the protocol's uniqueness and separation requirements. Reusing one PRF without domain separation can invalidate independence assumptions.
+- If GPU throughput is explicitly requested, analyze the concrete implementation's batching, memory access, and side channels. Performance analysis does not replace a security proof.
+- State the quantum query model. Grover gives a square-root improvement in ideal black-box query complexity, but concrete strength also depends on circuit depth, parallel resources, and the attack model; “halve the key bits” is not a complete assessment.
+
+## Risks and Failure Conditions
+
+- **Treating a concrete primitive as a theorem:** AES/HMAC PRF behavior is an adopted concrete-security assumption supported by analysis, not an unconditional theorem derived from the specification.
+- **Ignoring query and multi-user loss:** Query count, user count, and message length may amplify advantage through birthdays or hybrid steps.
+- **Confusing unpredictability and indistinguishability:** Their equivalence needs precise definitions and reductions; empirical prediction accuracy is not a cryptographic advantage.
+- **Treating generic constructions as engineering recipes:** HILL/GGM establish existence and reductions, not acceptable constants, parallelism, or throughput.
+- **Cross-domain model mismatch:** Side information, distribution shift, and adaptive ML queries may exceed the original security game.
+
+## Further References
+
+- `../../references/books/foundations-of-cryptography.md`: OWF/PRG theory and GGM.
+- `../../references/books/applied-cryptography.md`: PRF/PRP games and switching arguments.
+- `../../references/books/introduction-to-modern-cryptography.md`: formal definitions and Feistel.
+
+## Routing Extensions
+
+- Reductions: `reduction-proof-template.en.md`
+- Games: `attack-game-framework.en.md`
+- CPA/CCA/AE: `cca-cpa-ae-hierarchy.en.md`
+- Probability bounds: `../probability/concentration-inequality.en.md`

package/knowledge-base/cryptography/prf-prg-owf.md

@@ -0,0 +1,62 @@
+# 单向函数、伪随机生成器与伪随机函数 / OWF, PRG, and PRF
+
+## 最小定义
+
+- **单向函数（OWF）**：易于计算，但对随机输入的像，任何概率多项式时间（PPT）算法都只能以可忽略概率找到任一原像。
+- **伪随机生成器（PRG）**：确定性多项式时间算法 $G:\{0,1\}^n\to\{0,1\}^{\ell(n)}$，其中 $\ell(n)>n$，且 $G(U_n)$ 与 $U_{\ell(n)}$ 对所有 PPT 区分器计算不可区分。
+- **伪随机函数族（PRF）**：高效密钥函数族 $F_k:\mathcal X\to\mathcal Y$，其可查询接口与从所有 $\mathcal X\to\mathcal Y$ 函数中均匀抽取的真随机函数，对所有 PPT oracle 区分器计算不可区分。
+
+这些都是关于**安全参数增长下的族**的渐近定义，不是对某个固定参数实现的无条件结论。
+
+## 核心公式
+
+- OWF：对所有 PPT $A$，
+  $$\Pr_{x\leftarrow U_n}\left[f(A(1^n,f(x)))=f(x)\right]\le \operatorname{negl}(n).$$
+- PRG 优势：
+  $$\operatorname{Adv}^{\rm prg}_{G}(D)=\left|\Pr[D(G(U_n))=1]-\Pr[D(U_{\ell(n)}))=1]\right|.$$
+- PRF 优势：
+  $$\operatorname{Adv}^{\rm prf}_{F}(A)=\left|\Pr_{k}[A^{F_k}=1]-\Pr_{R}[A^{R}=1]\right|.$$
+- 存在性关系：OWF 存在当且仅当 PRG 存在；PRG 可经 GGM 构造 PRF。由 PRF 经 Feistel 可构造 PRP：经典 Luby--Rackoff 结论是 3 轮给出选择明文意义下的 PRP，4 轮给出允许正反向查询的强 PRP（具体界依赖查询数与分组长度）。
+- PRP/随机函数切换界的典型量级为生日界 $O(q^2/2^n)$；精确常数取决于采用的游戏和是否允许逆向查询，不能脱离版本固定写成唯一公式。
+
+## 适用问题
+
+- 判断一个 keyed construction 是否满足 PRF 定义，并写出真实/随机 oracle 游戏。
+- 用 hybrid argument 分析 GGM 类构造或从 PRF 构造加密/MAC。
+- 区分“标准模型中的存在性定理”“基于某原语的归约”和“把 AES/HMAC 当 PRF 的具体安全假设”。
+- 估计查询数带来的生日界损失，检查 key/domain separation 与多用户安全。
+
+## 密码学构造与跨域边界
+
+- 实用系统通常使用经分析的 PRF 候选或标准化构造（例如 HMAC、CMAC/KMAC 或基于分组密码的模式），而不是直接实现 HILL/GGM 的通用存在性构造。
+- 在 AI×密码交叉问题中，PRF 可作为带密钥、可复现的伪随机源，但结论只针对明确的 oracle/泄露模型。模型参数、梯度、日志或分布式训练若泄露密钥相关信息，原安全游戏可能不再适用。
+- OWF 不会自动让“哈希后的特征”保密：输入分布、辅助信息、碰撞和成员推断都需单独建模。
+- Yao 的 next-bit characterization 针对二进制分布族和高效预测器。它不能不经编码、条件分布与安全参数定义，直接推出自然语言模型“下一 token 难预测 ⇒ 整段输出伪随机”。
+
+## 实现注意事项
+
+- PRF 实现通常是位运算、置换、哈希/压缩函数或专用密码指令，不是“小 GEMM”。AES-NI/SHA-NI 是 CPU 指令集特性，不能作为 GPU 可行性的证据。
+- nonce、counter、domain tag 和派生子密钥必须按协议唯一/分离；“同一 PRF 到处复用”会破坏证明所需的独立性。
+- 若用户明确问 GPU 吞吐，再按具体实现分析并行批量、访存与侧信道；这属于性能检查，不替代安全证明。
+- 量子查询模型必须明确。Grover 给出理想黑盒查询复杂度的平方级加速，但具体安全强度还取决于电路深度、并行资源和攻击模型，不能只写“密钥位数减半”作为完整评估。
+
+## 风险与失效条件
+
+- **具体原语当定理**：AES/HMAC 的 PRF 性质是广泛采用的安全假设/分析结论，不是从其规范无条件证明出的定理。
+- **忽略查询与多用户损失**：$q$、用户数和消息长度可能通过生日界或 hybrid 次数放大优势。
+- **混淆不可预测与不可区分**：两者的等价需要精确定义与归约；经验预测准确率不能直接替代密码学优势。
+- **把通用构造当工程方案**：HILL/GGM 说明存在性和可归约性，不代表常数、并行性或吞吐可接受。
+- **跨域假设失配**：ML 部署中的侧信息、分布漂移和自适应查询可能超出原安全游戏。
+
+## 深入参考
+
+- `../../references/books/foundations-of-cryptography.md`：OWF/PRG 与 GGM 的理论链。
+- `../../references/books/applied-cryptography.md`：PRF/PRP 游戏和切换论证。
+- `../../references/books/introduction-to-modern-cryptography.md`：形式化定义与 Feistel 构造。
+
+## 路由扩展
+
+- 归约证明：`reduction-proof-template.md`
+- 攻击游戏：`attack-game-framework.md`
+- CPA/CCA/AE：`cca-cpa-ae-hierarchy.md`
+- 概率界：`../probability/concentration-inequality.md`