math-skill 3.2.0 → 3.3.0

package/knowledge-base/cryptography/reduction-proof-template.en.md

@@ -0,0 +1,60 @@
+# Reduction-Proof Template
+
+## Minimal Definition
+
+A security reduction constructs an algorithm $B$ that uses a scheme-breaking adversary $A$ as a subroutine to solve a defined hard problem. The conclusion is conditional: if the assumption remains hard for the resulting resources, and the simulation and parameter bounds hold, then no adversary in the corresponding resource range can break the scheme.
+
+## Core Formulas
+
+A typical concrete-security bound is
+$$
+\operatorname{Adv}^{\mathsf{scheme}}(A)
+\le L(q,n)\operatorname{Adv}^{\mathsf{assump}}(B)+\delta(q,n),
+$$
+where $L$ is reduction loss and $\delta$ collects collisions, simulation failures, and similar events. Report $B$'s running time and oracle queries as well as advantage.
+
+- Difference lemma: if games diverge only after `bad`, their advantage difference is at most $\Pr[\mathsf{bad}]$.
+- Hybrid: $|p_0-p_t|\le\sum_{i=0}^{t-1}|p_i-p_{i+1}|$; every step bound and the number of steps enter the final loss.
+- Asymptotic closure $\operatorname{poly}\cdot\operatorname{negl}=\operatorname{negl}$ does not imply an acceptable fixed-parameter value.
+
+## Applicable Problems
+
+- Prove encryption, MAC, signature, or protocol security from PRF/PRP, OWF, DDH/LWE, or related assumptions.
+- Check whether a reduction's simulation is perfect, statistically close, or computationally indistinguishable.
+- Track loss from guessing, rewinding, hybrids, and forking.
+- Compare standard-model, ROM/QROM, and black-box/non-black-box proof boundaries.
+
+## Cryptographic Construction and Cross-Domain Boundary
+
+- A reduction is not causal inference or an analogy between problems. It requires executable $B$, interface simulation, and a success-probability relation.
+- AI robustness or watermarking warrants a cryptographic-reduction claim only after defining a security game, parameter, adversarial resources, and hard problem. Ordinary Lipschitz certificates, generalization bounds, and differential-privacy guarantees are not “cryptographic hardness assumptions.”
+- Hybrid summation can analyze general distribution changes, but using that inequality alone does not create cryptographic security.
+- A simulator that reproduces some output distribution does not by itself prove training-data privacy; it needs a formal indistinguishability/simulation definition or a formal DP bound.
+
+## Implementation Considerations
+
+- Specify how $B$ generates parameters, answers every query, embeds the challenge, handles aborts, and extracts a solution from $A$.
+- Label every game hop as identical, statistically bounded, assumption-based, or bad-event-based.
+- Substitute advantage, time, queries, users, and failure terms into concrete parameters; “polynomial loss” is not a numerical analysis.
+- GPU performance is orthogonal to reduction validity. Analyze it separately only for a concrete primitive implementation.
+
+## Risks and Failure Conditions
+
+- **Wrong direction:** “Solving the assumption enables an attack” usually does not prove “an attack solves the assumption.”
+- **Unproved simulation:** If $A$ distinguishes the simulated view from the real game, its claimed advantage cannot be reused.
+- **Missing tightness/resources:** Small advantage loss can coexist with impractical time or query overhead.
+- **Model mismatch:** ROM/QROM, selective/adaptive, and single-/multi-user models cannot be switched silently.
+- **Uncounted abort/guessing:** Guessing an index or conditional abort can dominate the loss.
+- **Existence versus parameters:** An asymptotic reduction does not establish that the current key size is sufficient.
+
+## Further References
+
+- `../../references/books/foundations-of-cryptography.md`
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## Routing Extensions
+
+- Games: `attack-game-framework.en.md`
+- PRF/OWF: `prf-prg-owf.en.md`
+- CPA/CCA/AE: `cca-cpa-ae-hierarchy.en.md`

package/knowledge-base/cryptography/reduction-proof-template.md

@@ -0,0 +1,60 @@
+# 归约证明模板 / Reduction-Proof Template
+
+## 最小定义
+
+安全归约构造算法 $B$，把破坏方案的敌手 $A$ 当作子程序，用 $A$ 的成功来解决某个已定义的困难问题。正确结论是条件式：若假设问题对给定资源的算法仍困难，且模拟与参数界成立，则不存在相应资源范围内的成功敌手。
+
+## 核心公式
+
+典型具体安全界写成
+$$
+\operatorname{Adv}^{\mathsf{scheme}}(A)
+\le L(q,n)\operatorname{Adv}^{\mathsf{assump}}(B)+\delta(q,n),
+$$
+其中 $L$ 是归约损失，$\delta$ 汇总碰撞、模拟失败等项。必须同时报告 $B$ 的运行时间和 oracle 查询数，不能只比较优势。
+
+- Difference Lemma：两游戏仅在 `bad` 后分歧时，优势差至多 $\Pr[\mathsf{bad}]$。
+- Hybrid：$|p_0-p_t|\le\sum_{i=0}^{t-1}|p_i-p_{i+1}|$；每步界与步数都要进入最终损失。
+- 渐近闭合性 $\operatorname{poly}\cdot\operatorname{negl}=\operatorname{negl}$ 只说明最终仍可忽略，不说明固定参数下数值可接受。
+
+## 适用问题
+
+- 从 PRF/PRP、OWF、DDH/LWE 等假设证明加密、MAC、签名或协议安全。
+- 审查 reduction 的模拟是否完美/统计接近/计算不可区分。
+- 跟踪 guessing、rewinding、hybrid、forking 等步骤的损失。
+- 比较标准模型、ROM/QROM、黑盒/非黑盒证明的假设边界。
+
+## 密码学构造与跨域边界
+
+- 归约不是因果推断，也不是“两个问题相似”的类比；必须给出可执行的 $B$、接口模拟和成功概率关系。
+- AI 鲁棒性或水印只有在安全游戏、安全参数、敌手资源和底层困难问题都被正式定义时，才可声称密码学归约。普通 Lipschitz 证书、统计泛化界或差分隐私保证不是“密码学困难假设”。
+- Hybrid 的求和技巧可用于一般分布变化分析，但那只是数学不等式；不要因此宣称获得密码学安全。
+- 模拟器能生成某种输出分布，并不自动证明训练数据隐私；需要明确的 indistinguishability/simulation 定义或正式的 DP 参数。
+
+## 实现注意事项
+
+- 写出 $B$ 如何生成公共参数、回答每类查询、嵌入挑战、处理 abort，并从 $A$ 的输出提取解。
+- 为每个游戏跳转注明依据：完全相同、统计距离、计算假设或 bad-event bound。
+- 具体参数选择应把优势、时间、查询、多用户和失败项一起代入；不能用“多项式损失”替代数值分析。
+- GPU 性能与归约有效性正交；仅当用户问具体原语实现时另做性能分析。
+
+## 风险与失效条件
+
+- **方向写反**：从“能解假设 ⇒ 能攻击方案”通常不能推出“攻击方案 ⇒ 能解假设”。
+- **模拟不可分辨未证明**：$A$ 在模拟环境中的视图若与真实游戏可区分，调用其优势无效。
+- **紧度与资源漏项**：优势损失小但 $B$ 运行时间或查询数过大，仍可能没有有意义的具体安全。
+- **模型错配**：ROM/QROM、选择性/自适应安全、单用户/多用户之间不能静默切换。
+- **abort/guessing 未计入**：猜 challenge index 或条件中止会产生显著损失。
+- **把存在性当实用参数**：渐近归约成立不保证当前 key size 足够。
+
+## 深入参考
+
+- `../../references/books/foundations-of-cryptography.md`
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## 路由扩展
+
+- 攻击游戏：`attack-game-framework.md`
+- PRF/OWF：`prf-prg-owf.md`
+- CPA/CCA/AE：`cca-cpa-ae-hierarchy.md`

package/knowledge-base/matrix-analysis/low-rank-approximation.en.md

@@ -18,7 +18,7 @@ Given a matrix $A \in \mathbb{R}^{m \times n}$, find a matrix $B$ with rank at m
 - LoRA weight compression: $W \approx W_0 + BA$, $B \in \mathbb{R}^{d \times r}, A \in \mathbb{R}^{r \times d}$, $r \ll d$
 - KV-Cache compression: projecting Key/Value caches into a low-rank factor format, reducing memory from $O(Ld)$ to $O(Lk + kd)$; standard softmax still has sequence length $L$
 - PCA / whitening: the top $k$ principal components of the data covariance matrix correspond to the truncated SVD
-- Gradient compression: the effective rank of gradient matrices in large models is often much lower than the nominal rank, allowing safe truncation
+- Gradient compression: if measured singular values decay rapidly, truncate with error feedback to control bias. “Gradients are inherently low-rank and safe to truncate” is not a general theorem.
 - Recommender systems / matrix completion: low-rank factorization $R \approx UV^H$
 
 ## AI Design Translation
@@ -40,7 +40,7 @@ Given a matrix $A \in \mathbb{R}^{m \times n}$, find a matrix $B$ with rank at m
 
 - **Incorrect rank selection**: $k$ too small causes information loss ($\sigma_{k+1}$ is non-negligible); $k$ too large negates the compression benefit. Solution: monitor the singular value decay curve and select the elbow point where $\sum_{i>k}\sigma_i^2 / \sum\sigma_i^2 < \epsilon$.
 - **Insufficient randomized SVD accuracy**: When oversampling $p$ is too small (typically $p = 5 \sim 10$) or the number of power iteration steps is insufficient, low-order singular value estimates can be significantly biased. Solution: add $q = 1 \sim 2$ power iteration steps $Y = (AA^H)^q A\Omega$, at the cost of additional matmul operations.
-- **LoRA not applicable to all layers**: Q/K/V in attention is typically effectively low-rank, but the effective rank of FFN layers and embeddings may be close to full rank, and applying LoRA forcefully degrades accuracy. Layer-by-layer effective rank diagnosis is required.
+- **LoRA is not uniformly effective across layers**: Update spectra vary by layer and task; do not assume Q/K/V are low-rank while FFN/embeddings are full-rank. Compare per-layer spectra, validation loss, and equal-parameter baselines.
 - **SVD overhead of nuclear norm proximal**: Soft-thresholding $\text{prox}_{\lambda\|\cdot\|_*}(A) = U(\Sigma - \lambda I)_+ V^H$ requires SVD, which is prohibitively expensive for large matrices at every step. Solution: use factorization alternatives or randomized approximations.
 
 ## Further References

package/knowledge-base/matrix-analysis/low-rank-approximation.md

@@ -18,7 +18,7 @@
 - LoRA 权重压缩：$W \approx W_0 + BA$，$B \in \mathbb{R}^{d \times r}, A \in \mathbb{R}^{r \times d}$，$r \ll d$
 - KV-Cache 压缩：将 Key/Value 缓存投影到低秩因子格式，显存从 $O(Ld)$ 变为 $O(Lk + kd)$；标准 softmax 下序列长度仍为 $L$
 - PCA / 白化：数据协方差的前 $k$ 个主成分即截断 SVD
-- 梯度压缩：大模型梯度矩阵的有效秩通常远低于名义秩，可安全截断
+- 梯度压缩：若实测奇异值衰减快，可截断并用误差反馈控制偏差；“梯度天然低秩、可安全截断”不是普遍定理
 - 推荐系统 / 矩阵补全：低秩因子分解 $R \approx UV^H$
 
 ## AI 设计翻译
@@ -40,7 +40,7 @@
 
 - **秩选择错误**：$k$ 过小导致信息丢失（$\sigma_{k+1}$ 不可忽略），$k$ 过大失去压缩意义。解决：监控奇异值衰减曲线，选 $\sum_{i>k}\sigma_i^2 / \sum\sigma_i^2 < \epsilon$ 的拐点。
 - **随机化 SVD 精度不足**：oversampling $p$ 太小（通常 $p = 5 \sim 10$）或 power iteration 次数不足时，低阶奇异值估计偏差大。解决：增加 $q = 1 \sim 2$ 步 power iteration $Y = (AA^H)^q A\Omega$，但增加 matmul 次数。
-- **LoRA 不适用于所有层**：Attention 的 Q/K/V 通常低秩有效，但 FFN 层和 embedding 的有效秩可能接近满秩，强行 LoRA 会损失精度。需逐层诊断有效秩。
+- **LoRA 不适用于所有层**：不同层和任务的更新谱差异很大，不能预设 Q/K/V 一定低秩而 FFN/embedding 一定满秩。应比较逐层奇异值、验证损失与相同参数预算下的基线。
 - **核范数 proximal 的 SVD 开销**：soft-thresholding $\text{prox}_{\lambda\|\cdot\|_*}(A) = U(\Sigma - \lambda I)_+ V^H$ 需要 SVD，大矩阵每步算不起。解决：用因子化替代或随机化近似。
 
 ## 深入参考

package/knowledge-base/matrix-analysis/projection.en.md

@@ -6,9 +6,9 @@ Maps a vector $v$ onto a subspace $\mathcal{S}$ such that the residual $v - Pv$
 
 ## Core Formulas
 
-- Projection matrix: $P = A(A^HA)^{-1}A^H$, where the columns of $A$ span the subspace $\mathcal{S}$
+- If $A$ has full column rank and column space $\mathcal{S}$, then $P=A(A^HA)^{-1}A^H$; in general use the Moore--Penrose pseudoinverse, $P=AA^\dagger$
 - If the columns of $A$ are orthonormal ($A^HA = I$), then $P = AA^H$
-- Nearest distance after projection: $\|v - Pv\|^2 = \|v\|^2 - \|A^Hv\|^2$
+- If $Q$ is an orthonormal basis, then $\|v-QQ^Hv\|^2=\|v\|^2-\|Q^Hv\|^2$
 - Courant-Fischer variational characterization: $\lambda_k = \max_{\dim(S)=k} \min_{x \in S, \|x\|=1} x^HAx$
 - Orthogonal complement projection: $P^\perp = I - P$
 
@@ -16,30 +16,29 @@ Maps a vector $v$ onto a subspace $\mathcal{S}$ such that the residual $v - Pv$
 
 - Least squares regression: $\hat{x} = \arg\min \|Ax - b\|^2$ is equivalent to projecting $b$ onto $\text{Col}(A)$
 - PCA dimensionality reduction: projecting data onto the subspace spanned by the top $k$ principal components
-- Feasible directions in constrained optimization: projecting the gradient onto the constraint tangent space (projected gradient method)
+- Feasible directions for smooth equality constraints/manifolds: project the gradient onto the tangent space. General projected-gradient methods for convex constraints instead project the updated point back onto the feasible set.
 - Orthogonal decomposition in residual networks: decomposing a signal into an explained component + residual
 
 ## AI Design Translation
 
-- **Low-rank bottleneck analysis for linear layers**: The truncation $W = U_k \Sigma_k V_k^H$ is a projection onto a rank-$k$ subspace; implemented via `torch.mm(U_k, torch.mm(Sigma_k, V_k.t()))` as three matmul steps, reducing memory from $O(mn)$ to $O(k(m+n))$
-- **Subspace projection in attention heads**: The Q/K/V matrices essentially project inputs into different subspaces for similarity computation; multi-head = parallel projection subspaces, directly implementable as batched matmul
-- **Projection head (contrastive learning)**: The projection head in SimCLR/MoCo = a multi-layer MLP followed by $L_2$-normalize, equivalent to projecting onto the unit sphere; implemented as `F.normalize(self.mlp(x), dim=-1)`, an elementwise norm operation
+- **Low-rank bottleneck analysis for linear layers**: Truncated SVD $W_k=U_k\Sigma_kV_k^H$ is a best rank-$k$ approximation under the standard unitarily invariant norms and can be stored as factors using $O(k(m+n))$ parameters. This does not make $W_k$ a projection operator.
+- **Subspace maps in attention heads**: Q/K/V are generally learned linear maps, not orthogonal projections unless idempotence and Hermitian symmetry hold. Batched GEMM still implements multiple heads, but orthogonal head subspaces require an explicit constraint and verification.
+- **Projection heads in contrastive learning**: A SimCLR/MoCo projection head is an MLP. Final $L_2$ normalization maps nonzero vectors radially to the unit sphere; it is neither a linear projection nor Euclidean projection onto a convex set.
 - **Gradient projection / Orthogonal Gradient Descent (OGD)**: In continual learning, projecting the new-task gradient onto the orthogonal complement of the old-task gradient space to avoid catastrophic forgetting; requires maintaining a basis matrix $G$ and computing $(I - G(G^TG)^{-1}G^T)\nabla$, with the core being two matmul operations
-- **Orthogonal residuals in ResNet**: The residual connection $x + F(x)$ can be interpreted as a projection onto the identity subspace + orthogonal correction; spectral normalization constrains the Lipschitz constant of $F$ to stabilize the projection
 
 ## Engineering Feasibility
 
-- **Primary operations**: Matrix multiplication (matmul) + matrix inversion/Cholesky. When the subspace dimension $k$ is much smaller than $n$, $(A^HA)^{-1}$ only requires inverting a $k \times k$ matrix, at negligible cost.
-- **GPU friendliness**: High. $P = AA^H$ (orthonormal columns case) is two matmul operations, perfectly mapped to tensor cores. The Cholesky decomposition for the non-orthogonal case has cuSOLVER batched implementations.
-- **Complexity**: Projection operation $O(nk)$ per vector (orthonormal basis case), basis construction $O(nk^2)$ (Gram-Schmidt) or $O(n^2k)$ (QR decomposition).
-- **Low precision**: Under bf16, $A^HA$ may lose positive definiteness; a jitter $\epsilon I$ ($\epsilon \sim 10^{-6}$) must be added.
+- **Primary operations**: Given an orthonormal basis $Q\in\mathbb{R}^{n\times k}$, apply the projection as $Q(Q^Hx)$ rather than materializing an $n\times n$ matrix. To obtain a basis from non-orthogonal $A$, prefer QR/SVD over explicitly forming $(A^HA)^{-1}$.
+- **GPU friendliness**: Projection application is two GEMV/GEMM operations. Large batches can use Tensor Cores; small $k$ or single-vector workloads may be launch- or memory-bound, so matmul expressibility alone does not imply high utilization.
+- **Complexity**: Applying the projection costs $O(nk)$ per vector. Thin QR of an $n\times k$ matrix with $n\ge k$ is typically $O(nk^2)$.
+- **Low precision**: Normal equations square the condition number. Jitter must be scaled to the data, dtype, and error tolerance; $10^{-6}$ is not universal. Prefer fp32 accumulation and QR/SVD.
 
 ## Risks and Failure Conditions
 
 - **Ill-conditioned basis matrix**: When the condition number $\kappa(A) \gg 1$, $(A^HA)^{-1}$ suffers catastrophic cancellation under low precision. Solution: first perform QR decomposition to obtain an orthonormal basis $Q$, then use $P = QQ^H$, avoiding explicit inversion.
 - **Excessively high subspace dimension**: When $k$ approaches $n$, the projection degenerates to the identity mapping, wasting computation. A randomized SVD should first be performed to confirm the effective rank.
 - **Non-stationary subspace**: In online/continual learning, the projection basis drifts with the data; the basis matrix must be periodically updated (incremental QR), otherwise the projection directions become stale.
-- **Non-orthogonal projection**: Oblique projections where $P^2 = P$ but $P \neq P^H$ are numerically unstable in floating point and should be avoided; if they must be used, monitor $\|P - P^H\|_F$.
+- **Oblique projection**: If $P^2=P$ but $P\ne P^H$, the map no longer gives Euclidean nearest points. Stability depends on the angle/conditioning between its range and null space; $\|P-P^H\|_F$ alone is not a sufficient diagnostic. Monitor the operator norm or basis conditioning.
 
 ## Further References
 

package/knowledge-base/matrix-analysis/projection.md

@@ -6,9 +6,9 @@
 
 ## 核心公式
 
-- 投影矩阵：$P = A(A^HA)^{-1}A^H$，其中 $A$ 的列张成子空间 $\mathcal{S}$
+- 若 $A$ 满列秩且列空间为 $\mathcal{S}$，投影矩阵为 $P = A(A^HA)^{-1}A^H$；一般情形用 Moore--Penrose 伪逆写成 $P=AA^\dagger$
 - 若 $A$ 列正交归一（$A^HA = I$），则 $P = AA^H$
-- 投影后最近距离：$\|v - Pv\|^2 = \|v\|^2 - \|A^Hv\|^2$
+- 若 $Q$ 是子空间的正交基，则：$\|v-Q Q^Hv\|^2=\|v\|^2-\|Q^Hv\|^2$
 - Courant-Fischer 变分刻画：$\lambda_k = \max_{\dim(S)=k} \min_{x \in S, \|x\|=1} x^HAx$
 - 正交补投影：$P^\perp = I - P$
 
@@ -16,30 +16,29 @@
 
 - 最小二乘回归：$\hat{x} = \arg\min \|Ax - b\|^2$ 即求 $b$ 在 $\text{Col}(A)$ 上的投影
 - PCA 降维：数据投影到前 $k$ 个主成分张成的子空间
-- 约束优化中的可行方向：将梯度投影到约束切空间（投影梯度法）
+- 光滑等式约束/流形优化中的可行方向：将梯度投影到切空间；一般凸约束的 projected gradient 则把更新点投影回可行集
 - 残差网络的正交分解：将信号分解为已解释部分 + 残差
 
 ## AI 设计翻译
 
-- **Linear 层的低秩瓶颈分析**：$W = U_k \Sigma_k V_k^H$ 的截断即投影到秩-$k$ 子空间；用 `torch.mm(U_k, torch.mm(Sigma_k, V_k.t()))` 三步 matmul 实现，显存从 $O(mn)$ 降到 $O(k(m+n))$
-- **Attention 头的子空间投影**：Q/K/V 矩阵本质是把输入投影到不同子空间做相似度计算；多头 = 多个投影子空间的并行，可直接 batched matmul
-- **Projection Head (对比学习)**：SimCLR/MoCo 的 projection head = 多层 MLP 后接 $L_2$-normalize，等价于投影到单位球面；实现为 `F.normalize(self.mlp(x), dim=-1)`，是 elementwise norm 操作
+- **Linear 层的低秩瓶颈分析**：截断 SVD $W_k=U_k\Sigma_kV_k^H$ 是矩阵范数下的最佳秩-$k$ 逼近，可存为两个因子以把参数量从 $O(mn)$ 降到 $O(k(m+n))$；这不等于说 $W_k$ 本身是投影算子
+- **Attention 头的子空间映射**：Q/K/V 通常只是学习到的线性映射；只有满足幂等与 Hermitian 条件时才是正交投影。多头实现仍可用 batched GEMM，但“不同头对应正交子空间”需要额外约束与验证
+- **Projection Head（对比学习）**：SimCLR/MoCo 的 projection head 是 MLP；末端 $L_2$ normalization 把非零向量径向归一到单位球面，但它不是线性投影，也不是投到凸集的欧氏最近点映射
 - **梯度投影 / 正交梯度下降 (OGD)**：在持续学习中，将新任务梯度投影到旧任务梯度空间的正交补，避免灾难性遗忘；需维护基矩阵 $G$ 并计算 $(I - G(G^TG)^{-1}G^T)\nabla$，核心是两次 matmul
-- **ResNet 的正交残差**：残差连接 $x + F(x)$ 可理解为在恒等子空间上的投影 + 正交修正；谱归一化约束 $F$ 的 Lipschitz 使投影稳定
 
 ## 工程可行性
 
-- **主要操作**：矩阵乘法 (matmul) + 矩阵求逆/Cholesky。当子空间维度 $k$ 远小于 $n$ 时，$(A^HA)^{-1}$ 只需对 $k \times k$ 矩阵求逆，代价可忽略。
-- **GPU 友好度**：高。$P = AA^H$（列正交情形）是两次 matmul，完美映射 tensor core。非正交情形的 Cholesky 分解有 cuSOLVER batched 实现。
-- **复杂度**：投影操作 $O(nk)$ per vector（正交基情形），构造基 $O(nk^2)$（Gram-Schmidt）或 $O(n^2k)$（QR 分解）。
-- **低精度**：bf16 下 $A^HA$ 可能丢正定性，需加 jitter $\epsilon I$（$\epsilon \sim 10^{-6}$）。
+- **主要操作**：对已有正交基 $Q\in\mathbb{R}^{n\times k}$ 应直接计算 $Q(Q^Hx)$，避免显式物化 $n\times n$ 的 $P$。若从非正交 $A$ 构造基，优先用 QR/SVD 而非显式形成 $(A^HA)^{-1}$。
+- **GPU 友好度**：应用投影主要是两次 GEMV/GEMM；批量足够大时可利用 Tensor Core。小 $k$ 或单向量场景可能受内存/launch 开销限制，不能仅凭“可写成 matmul”断言高利用率。
+- **复杂度**：应用投影为每向量 $O(nk)$；对 $n\times k$（$n\ge k$）矩阵做 thin QR 通常为 $O(nk^2)$。
+- **低精度**：形成正规方程会把条件数平方。jitter 的大小依赖数据尺度、dtype 与容许偏差，不存在通用的 $10^{-6}$；稳定方案是以 fp32 累加并用 QR/SVD。
 
 ## 风险与失效条件
 
 - **基矩阵病态**：当 $A$ 条件数 $\kappa(A) \gg 1$ 时，$(A^HA)^{-1}$ 在低精度下灾难性抵消。解决：先 QR 分解得正交基 $Q$，再用 $P = QQ^H$，避免显式求逆。
 - **子空间维度过高**：$k$ 接近 $n$ 时投影退化为恒等映射，计算浪费。需先做随机 SVD 确认有效秩。
 - **非平稳子空间**：在线学习/持续学习中投影基随数据漂移，需定期更新基矩阵（增量 QR），否则投影方向过期。
-- **非正交投影**：$P^2 = P$ 但 $P \neq P^H$ 的斜投影在浮点下不稳定，应避免；若必须用，需监控 $\|P - P^H\|_F$。
+- **斜投影**：$P^2=P$ 但 $P\ne P^H$ 时不再给出欧氏最近点；其稳定性取决于像空间与核空间的夹角/条件数，不能仅用 $\|P-P^H\|_F$ 判定。需要显式监控算子范数或相关基的条件数。
 
 ## 深入参考
 

package/knowledge-base/overview.en.md

@@ -4,7 +4,7 @@
 
 ## Knowledge Base Structure
 
-The knowledge base is organized by mathematical domain, with 7 domains and 31 knowledge cards. Each card contains: minimal definition, core formulas, applicable problems, AI design translation, engineering feasibility, risks and failure conditions.
+The knowledge base has 9 domain directories and 37 cards: 33 shared-math anchors across 8 domains, plus 4 domain-specific cryptography anchors. Shared-math cards may include AI/engineering translations when relevant; cryptography cards preserve security-definition, construction, and reduction semantics without forcing AI or GPU sections.
 
 | Domain | Directory | Cards | Typical Applications |
 |--------|-----------|-------|---------------------|
@@ -15,6 +15,8 @@ The knowledge base is organized by mathematical domain, with 7 domains and 31 kn
 | Topology | `topology/` | persistent-homology, euler-characteristic, fundamental-group | Topological regularization, latent space monitoring |
 | Probability & Information | `probability/` | concentration-inequality, entropy, kl-divergence, information-bottleneck, fisher-information | VAE, knowledge distillation, generalization bounds |
 | Information Geometry | `information-geometry/` | natural-gradient, fisher-metric | Natural gradient descent, Fisher-Rao metric |
+| Algebraic Geometry | `algebraic-geometry/` | grassmannian-plucker, sheaf-cohomology | Subspace parameterization, local-to-global consistency |
+| Cryptography (domain-specific) | `cryptography/` | prf-prg-owf, attack-game-framework, cca-cpa-ae-hierarchy, reduction-proof-template | Security definitions, constructions, games, and reductions |
 
 ## From Problem to Knowledge Card
 
@@ -30,13 +32,13 @@ The knowledge base is organized by mathematical domain, with 7 domains and 31 kn
 
 ## When Anchors Are Not Enough
 
-The current 31 anchors cover the most commonly used mathematical structures in AI research. When a problem requires mathematical tools not among them:
+The current 33 shared-math anchors and 4 cryptography anchors cover high-frequency structures. When a problem requires a tool not among them:
 
 1. Check the corresponding domain's `*/index.en.md` (e.g., `topology/index.en.md`) for extended concepts and reference book directions
-2. Enter the **Knowledge Gap Protocol** defined in `../skills/math-research-activator/SKILL.en.md` to generate a temporary knowledge card
+2. Enter the **Knowledge Gap Protocol** in root `../SKILL.en.md` to generate a temporary knowledge card
 3. Never respond with "knowledge base does not cover this" or force-fit the closest card
 
-> **Domain Router note** (v3.2.0): This knowledge base primarily serves the **AI Research Layer** and **Shared Math Layer**. If Domain Router determines the problem belongs to the **Cryptography Layer**, first consult the three crypto books listed in `../references/skill-index.en.md`; shared math anchors (e.g., `probability/entropy`, `matrix-analysis/spectral-decomposition`) are loaded on demand without redundancy. Crypto-specific concepts (OWF/PRF/CCA/reduction proofs etc.) are not among these 31 anchors; activate them via temporary knowledge cards or the crypto books.
+> **Domain Router note**: For pure cryptography, load the smallest relevant card under `cryptography/` first; consult `../references/books/` only when the anchors are insufficient or literature-level depth is requested. Shared-math anchors are loaded on demand without duplicating cryptographic semantics. A pure AI request does not enter the crypto route merely because it contains words such as “hash,” “attack,” or “security.”
 
 ## Domain Extension Index
 
@@ -51,3 +53,5 @@ Each domain has an `*/index.en.md` that lists: domain trigger signals, core anch
 | Topology | `topology/index.en.md` |
 | Probability & Information | `probability/index.en.md` |
 | Information Geometry | `information-geometry/index.en.md` |
+| Algebraic Geometry | `algebraic-geometry/index.en.md` |
+| Cryptography | `cryptography/index.en.md` |

package/knowledge-base/overview.md

@@ -4,7 +4,7 @@
 
 ## 知识库结构
 
-知识库按数学领域组织，共 7 个领域、31 张知识卡片。每张卡片包含：最小定义、核心公式、适用问题、AI 设计翻译、工程可行性、风险与失效条件。
+知识库按领域组织，共 9 个目录、37 张知识卡片：其中 8 个共享数学领域含 33 张锚点，密码学领域含 4 张专属锚点。共享数学卡按需给出 AI/工程翻译；密码学卡优先保持安全定义、构造与归约语义，不强塞 AI 或 GPU 模板。
 
 | 领域 | 目录 | 卡片 | 典型应用 |
 |------|------|------|---------|
@@ -15,6 +15,8 @@
 | 拓扑 | `topology/` | persistent-homology, euler-characteristic, fundamental-group | 拓扑正则、隐空间监控 |
 | 概率与信息 | `probability/` | concentration-inequality, entropy, kl-divergence, information-bottleneck, fisher-information | VAE、知识蒸馏、泛化界 |
 | 信息几何 | `information-geometry/` | natural-gradient, fisher-metric | 自然梯度下降、Fisher-Rao 度量 |
+| 代数几何 | `algebraic-geometry/` | grassmannian-plucker, sheaf-cohomology | 子空间参数化、局部到整体一致性 |
+| 密码学（领域专属） | `cryptography/` | prf-prg-owf, attack-game-framework, cca-cpa-ae-hierarchy, reduction-proof-template | 安全定义、构造、攻击游戏、归约证明 |
 
 ## 从问题找知识卡
 
@@ -30,13 +32,13 @@
 
 ## 当锚点不够时
 
-现有 31 个锚点覆盖 AI 研究中最常用的数学结构。当问题需要的数学工具不在其中时：
+现有 33 个共享数学锚点与 4 个密码学锚点覆盖高频结构。当问题需要的工具不在其中时：
 
 1. 查看对应领域的 `*/index.md`（如 `topology/index.md`），获取扩展概念和参考书方向
-2. 进入 `../skills/math-research-activator/SKILL.md` 中定义的**知识缺口协议**，生成临时知识卡
+2. 进入根 `../SKILL.md` 中定义的**知识缺口协议**，生成临时知识卡
 3. 不得回答"知识库未覆盖"或强行套用最相近卡片
 
-> **Domain Router 提示**（v3.2.0）：本知识库主要服务 **AI 研究层** 与 **共用数学层**。若 Domain Router 判定问题属**密码学层**，优先查阅 `../references/skill-index.md` 列出的 3 本密码学书稿；共用数学锚点（如 `probability/entropy`、`matrix-analysis/spectral-decomposition`）按需加载，不重复。密码学专属概念（OWF/PRF/CCA/归约证明等）不在此 31 锚点内，通过临时知识卡或密码学书稿激活。
+> **Domain Router 提示**：纯密码问题先加载 `cryptography/` 的最小相关锚点；只有锚点不足或用户要求文献级深度时才查 `../references/books/`。共享数学锚点按需加载且不复制密码学语义。纯 AI 问题不因出现 “hash”“attack”“security”等单词就自动进入密码学路由。
 
 ## 领域扩展索引
 
@@ -51,3 +53,5 @@
 | 拓扑 | `topology/index.md` |
 | 概率与信息 | `probability/index.md` |
 | 信息几何 | `information-geometry/index.md` |
+| 代数几何 | `algebraic-geometry/index.md` |
+| 密码学 | `cryptography/index.md` |

package/knowledge-base/probability/kl-divergence.en.md

@@ -1,7 +1,7 @@
 # KL Divergence
 
 ## Minimal Definition
-Kullback-Leibler divergence measures the **information loss** when a probability distribution $q$ is used to approximate the true distribution $p$ — that is, the average number of extra bits spent when encoding $p$ using $q$. It is not a metric (it is asymmetric and does not satisfy the triangle inequality), but it defines a natural "directional distance" on the probability simplex.
+Kullback--Leibler divergence compares the relative information in $p$ and $q$. Under the coding interpretation, it is the excess expected code length when data from $p$ are encoded with a code optimized for $q$: units are bits for $\log_2$ and nats for the natural logarithm. It is asymmetric and violates the triangle inequality, so it is not a metric.
 
 ## Core Formulas
 
@@ -12,14 +12,14 @@ $$D_{KL}(p \| q) = \sum_x p(x) \log \frac{p(x)}{q(x)} = \mathbb{E}_{p}\left[\log
 $$D_{KL}(p \| q) = \int p(x) \log \frac{p(x)}{q(x)}\, dx$$
 
 **Fundamental properties**:
-- $D_{KL}(p \| q) \geq 0$ (Gibbs' inequality), with equality if and only if $p = q$
+- $D_{KL}(p \| q) \geq 0$ (Gibbs' inequality); when $p$ is absolutely continuous with respect to $q$, equality holds iff $p=q$ almost everywhere
 - **Asymmetric**: $D_{KL}(p \| q) \neq D_{KL}(q \| p)$, hence it is not a metric
 
 **Relationship to cross-entropy and entropy**:
 $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 **Semantic difference between the two directions**:
-- **Forward KL** $D_{KL}(p \| q)$: $q$ tends to cover all modes of $p$ (mean-seeking)
+- **Forward KL** $D_{KL}(p \| q)$: when $p$ is the target and $q$ belongs to a restricted approximation family, missing regions with positive $p$ mass is heavily penalized; “mass-covering” is more precise than the context-dependent phrase “mean-seeking”
 - **Reverse KL** $D_{KL}(q \| p)$: $q$ tends to lock onto a single mode of $p$ (mode-seeking)
 
 ## Applicable Problems
@@ -37,11 +37,11 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 - **D2[~]**: KL itself is not a GEMM, but its inputs (logits) come from GEMM layers
 - **D3[v]**: $O(|\mathcal{X}|)$ linear
 - **D4[~]**: For large vocabularies, both $p$ and $q$ probability vectors must be held simultaneously; chunked computation is possible
-- **D5[v]**: Log-softmax differences are stable in bf16; note that $\log q$ diverges as $q \to 0$, requiring clamping
+- **D5[~]**: Compute from logits with `log_softmax` rather than softmax-then-log and accumulate in fp32. Arbitrary clamping changes the objective and is not an unbiased numerical fix.
 - **D8[v]**: Can be fused with softmax into FusedKLDivLoss
 
 ## Risks and Failure Conditions
-- **KL diverges to infinity when $q(x)=0$ but $p(x)>0$**: In practice, label smoothing or temperature scaling must be applied to $q$ to avoid zero probabilities. The mode-seeking behavior of reverse KL can exacerbate this issue — the student model "drops" low-probability regions of the teacher distribution.
+- **Support mismatch**: If $p(x)>0$ where $q(x)=0$, then $D_{KL}(p\|q)=\infty$. Exact softmax probabilities are positive, but finite precision can underflow; compute in log space. Smoothing is a modeling choice, not a universal requirement.
 - **High gradient variance**: In RL (PPO/RLHF), KL estimation relies on sampling; high variance can lead to training instability. A clipped + linear approximation $\mathbb{E}[\log p - \log q]$ is commonly used in place of the exact KL.
 
 ## Further References
@@ -53,7 +53,7 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 ## Routing Extensions
 - If used for IB objective -> `information-bottleneck.en.md` (IB defines objective using KL)
-- If the absolute version is needed -> `entropy.en.md` (KL divergence reduces to entropy)
+- For the cross-entropy identity -> `entropy.en.md` ($D_{KL}(p\|q)=H(p,q)-H(p)$)
 - If local KL geometry is needed -> `fisher-information.en.md` (Fisher information is local curvature of KL)
 
 ## Extensible Directions

package/knowledge-base/probability/kl-divergence.md

@@ -1,7 +1,7 @@
 # KL 散度 / KL Divergence
 
 ## 最小定义
-Kullback-Leibler 散度度量一个概率分布 $q$ 相对于真实分布 $p$ 的**信息损失**——即用 $q$ 编码 $p$ 时多花的平均比特数。它不是度量（不对称、不满足三角不等式），但在概率单纯形上定义了自然的"方向性距离"。
+Kullback--Leibler 散度比较 $p$ 与 $q$ 的相对信息。满足编码解释的条件下，它等于用针对 $q$ 的码描述来自 $p$ 的样本所增加的期望码长；以 $\log_2$ 计单位为 bit，以自然对数计单位为 nat。它不对称且不满足三角不等式，因此不是距离度量。
 
 ## 核心公式
 
@@ -12,14 +12,14 @@ $$D_{KL}(p \| q) = \sum_x p(x) \log \frac{p(x)}{q(x)} = \mathbb{E}_{p}\left[\log
 $$D_{KL}(p \| q) = \int p(x) \log \frac{p(x)}{q(x)}\, dx$$
 
 **基本性质**：
-- $D_{KL}(p \| q) \geq 0$（Gibbs 不等式），等号当且仅当 $p = q$
+- $D_{KL}(p \| q) \geq 0$（Gibbs 不等式）；在 $p$ 对 $q$ 绝对连续时，等号当且仅当 $p=q$（几乎处处）
 - **不对称**：$D_{KL}(p \| q) \neq D_{KL}(q \| p)$，因此不是度量
 
 **与交叉熵/熵的关系**：
 $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 **两种方向的语义差异**：
-- **前向 KL** $D_{KL}(p \| q)$：$q$ 倾向于覆盖 $p$ 的所有模式（mean-seeking）
+- **前向 KL** $D_{KL}(p \| q)$：当 $p$ 是目标、$q$ 是受限近似族时，遗漏 $p$ 有质量的区域会受重罚，通常称 mass-covering；“mean-seeking”只是部分例子的现象
 - **反向 KL** $D_{KL}(q \| p)$：$q$ 倾向于锁定 $p$ 的某一个模式（mode-seeking）
 
 ## 适用问题
@@ -37,11 +37,11 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 - **D2[~]**：KL 本身不是 GEMM，但输入（logits）来自 GEMM 层
 - **D3[v]**：$O(|\mathcal{X}|)$ 线性
 - **D4[~]**：大 vocab 下需同时保留 $p$ 和 $q$ 的完整概率向量，可 chunk 计算
-- **D5[v]**：log-softmax 差值在 bf16 下稳定；注意 $q \to 0$ 时 $\log q$ 发散，需 clamp
+- **D5[~]**：从 logits 用 `log_softmax` 计算比先 softmax 再取 log 稳定；低精度累加宜用 fp32。任意 clamp 都会改变目标，不能当作无偏数值修复
 - **D8[v]**：可与 softmax 融合为 FusedKLDivLoss
 
 ## 风险与失效条件
-- **$q(x)=0$ 但 $p(x)>0$ 时 KL 发散为无穷**：实践中必须对 $q$ 做 label smoothing 或温度缩放，避免零概率。反向 KL 的 mode-seeking 行为可加剧此问题——学生模型"丢弃"教师分布的低概率区域。
+- **支持集不匹配**：若某处 $p(x)>0$ 而 $q(x)=0$，则 $D_{KL}(p\|q)=\infty$。softmax 的精确数学输出为正，但有限精度下可能下溢；可在 log-space 计算，是否使用 smoothing 取决于建模目标而非硬性要求。
 - **梯度方差大**：在 RL（PPO/RLHF）中，KL 估计依赖采样，高方差可导致训练不稳定。常用 clip + 线性近似 $\mathbb{E}[\log p - \log q]$ 替代精确 KL。
 
 ## 深入参考
@@ -53,7 +53,7 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 ## 路由扩展
 - 若用于 IB 目标函数 → `information-bottleneck.md`（IB 使用 KL 定义目标）
-- 若需要绝对版本 → `entropy.md`（KL 散度退化为熵）
+- 若需要交叉熵关系 → `entropy.md`（$D_{KL}(p\|q)=H(p,q)-H(p)$）
 - 若需要局部 KL 几何 → `fisher-information.md`（Fisher 信息是 KL 的局部曲率）
 
 ## 可扩展方向

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "math-skill",
-  "version": "3.2.0",
-  "description": "面向 AI 架构创新与密码学研究的数学研究操作系统 v3.2：思想透镜 / 激活锚点 / 设计翻译原型 + Domain Router（AI/密码/纯数学/交叉），支持知识缺口协议与临时知识卡。Math Research OS for AI architecture & cryptography research: thinking lenses + activation anchors + design translation prototypes + Domain Router with Knowledge Gap Protocol.",
+  "version": "3.3.0",
+  "description": "面向 AI 架构创新与密码学研究的数学研究路由器：15 个思想透镜、33 个共用数学锚点、4 个密码学锚点、22 个 AI 设计原型，以及渐进加载、Domain Router 与 Knowledge Gap Protocol。Math research router for AI architecture and cryptography with progressive loading, domain isolation, and explicit token budgets.",
   "keywords": [
     "math",
     "mathematics",
@@ -67,6 +67,8 @@
   "files": [
     "README.md",
     "README.en-US.md",
+    "SKILL.md",
+    "SKILL.en.md",
     "LICENSE",
     "commands/",
     "skills/",

package/references/agentic-workflow.en.md

@@ -28,7 +28,7 @@
 
 1. **Diagnosis**: What is the algorithmic structure / bottleneck of the problem? (Do not start by piling on math tutorials.)
 2. **Cross-domain activation**: Scan `books/*.md` for transferable modern mathematical structures, **enumerate multiple candidates** (leveraging the model's large-context advantage).
-3. **Dual acceptance gate**: Each candidate passes two gates — (1) Mathematically correct (differentiable, self-consistent, with correctness guarantees); (2) GPU-feasible (the eight dimensions of `gpu-friendly-math.en.md`).
+3. **Dual acceptance gate**: Each candidate passes two gates — (1) mathematically correct, with theorems separated from assumptions and heuristics; (2) compatible with task-relevant engineering constraints. For GPU work, assess the applicable dimensions in `gpu-friendly-math.en.md` and mark the rest `N/A`.
 4. **Iterative tracking**: Record candidates, scores, and status in a markdown test plan, converging step by step.
 
 ## Markdown Test Plan Template / Tracking Template
@@ -36,7 +36,7 @@
 Record research tasks in a table that the Agent can continuously update:
 
 ```markdown
-| Candidate Structure | Math Correctness | GPU 8-Dim | Complexity | Status | Notes / Next Steps |
+| Candidate Structure | Math Correctness | Applicable GPU Dimensions | Complexity | Status | Notes / Next Steps |
 |--------------------|-----------------|-----------|------------|--------|-------------------|
 | Tropical gating replacing TopK | [v] Differentiable relaxation | 1[v]2[x]3[v]… | Sub-quadratic (per-token) | Verifying | Compare with SWA baseline |
 | …                  |                 |           |            | Todo   |                   |

package/references/agentic-workflow.md

@@ -30,7 +30,7 @@
 
 1. **诊断**：问题的算法结构 / 瓶颈是什么？（不要一上来堆数学科普。）
 2. **跨域激活**：用 `books/*.md` 扫描可迁移的现代数学结构，**枚举多个候选**（发挥模型大上下文优势）。
-3. **双验收门**：每个候选过两关——① 数学正确（可微、自洽、有保证）；② GPU 可行（`gpu-friendly-math.md` 八维）。
+3. **双验收门**：每个候选过两关——① 数学正确（区分定理、假设与启发式）；② 满足任务相关的工程约束。涉及 GPU 时按 `gpu-friendly-math.md` 评估相关维度，无关项标 `N/A`。
 4. **迭代追踪**：用 markdown testplan 记录候选、评分、状态，逐步收敛。
 
 ## markdown testplan 模板 / Tracking Template
@@ -38,7 +38,7 @@
 把研究任务写进一张可被 Agent 持续更新的表：
 
 ```markdown
-| 候选结构 | 数学正确性 | GPU 八维 | 复杂度 | 状态 | 备注/下一步 |
+| 候选结构 | 数学正确性 | 相关 GPU 维度 | 复杂度 | 状态 | 备注/下一步 |
 |---------|-----------|---------|-------|------|-----------|
 | 热带门控替代 TopK | [v] 可微松弛 | 1[v]2[x]3[v]… | 亚二次(逐token) | 验证中 | 对比 SWA 基线 |
 | …            |           |         |       | 待办 |           |