math-skill 3.2.0 → 3.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.en-US.md +74 -39
- package/README.md +81 -46
- package/SKILL.en.md +122 -0
- package/SKILL.md +122 -0
- package/agents/math-critic.en.md +32 -18
- package/agents/math-critic.md +33 -18
- package/commands/ask.en.md +3 -2
- package/commands/ask.md +3 -2
- package/design-patterns/compression/low-rank-kv-cache.en.md +1 -0
- package/design-patterns/loss/orthogonality-loss.en.md +7 -7
- package/design-patterns/loss/orthogonality-loss.md +7 -7
- package/knowledge-base/algebraic-geometry/grassmannian-plucker.en.md +71 -0
- package/knowledge-base/algebraic-geometry/grassmannian-plucker.md +71 -0
- package/knowledge-base/algebraic-geometry/index.en.md +47 -0
- package/knowledge-base/algebraic-geometry/index.md +47 -0
- package/knowledge-base/algebraic-geometry/sheaf-cohomology.en.md +72 -0
- package/knowledge-base/algebraic-geometry/sheaf-cohomology.md +72 -0
- package/knowledge-base/cryptography/attack-game-framework.en.md +56 -0
- package/knowledge-base/cryptography/attack-game-framework.md +56 -0
- package/knowledge-base/cryptography/cca-cpa-ae-hierarchy.en.md +57 -0
- package/knowledge-base/cryptography/cca-cpa-ae-hierarchy.md +57 -0
- package/knowledge-base/cryptography/index.en.md +54 -0
- package/knowledge-base/cryptography/index.md +54 -0
- package/knowledge-base/cryptography/prf-prg-owf.en.md +62 -0
- package/knowledge-base/cryptography/prf-prg-owf.md +62 -0
- package/knowledge-base/cryptography/reduction-proof-template.en.md +60 -0
- package/knowledge-base/cryptography/reduction-proof-template.md +60 -0
- package/knowledge-base/matrix-analysis/low-rank-approximation.en.md +2 -2
- package/knowledge-base/matrix-analysis/low-rank-approximation.md +2 -2
- package/knowledge-base/matrix-analysis/projection.en.md +11 -12
- package/knowledge-base/matrix-analysis/projection.md +11 -12
- package/knowledge-base/overview.en.md +8 -4
- package/knowledge-base/overview.md +8 -4
- package/knowledge-base/probability/kl-divergence.en.md +6 -6
- package/knowledge-base/probability/kl-divergence.md +6 -6
- package/package.json +8 -35
- package/references/agentic-workflow.en.md +2 -2
- package/references/agentic-workflow.md +2 -2
- package/references/books/abstract-algebra.en.md +18 -29
- package/references/books/abstract-algebra.md +18 -29
- package/references/books/algebraic-geometry-rising-sea.en.md +1 -1
- package/references/books/algebraic-geometry-rising-sea.md +2 -2
- package/references/books/applied-cryptography.en.md +112 -0
- package/references/books/applied-cryptography.md +18 -19
- package/references/books/differential-geometry.md +1 -1
- package/references/books/foundations-of-cryptography.en.md +112 -0
- package/references/books/foundations-of-cryptography.md +20 -20
- package/references/books/introduction-to-modern-cryptography.en.md +130 -0
- package/references/books/introduction-to-modern-cryptography.md +21 -21
- package/references/books/micro-lie-theory.en.md +1 -1
- package/references/books/micro-lie-theory.md +1 -1
- package/references/books/smooth-manifolds.en.md +1 -1
- package/references/books/smooth-manifolds.md +1 -1
- package/references/gpu-friendly-math.en.md +8 -8
- package/references/gpu-friendly-math.md +8 -8
- package/references/inspiration.en.md +8 -84
- package/references/inspiration.md +8 -84
- package/references/musings.en.md +87 -0
- package/references/musings.md +87 -0
- package/references/skill-index.en.md +32 -22
- package/references/skill-index.md +29 -19
- package/skills/math-research-activator/SKILL.en.md +4 -193
- package/skills/math-research-activator/SKILL.md +4 -214
- package/skills/math-research-activator/original-texts.en.md +6 -4
- package/skills/math-research-activator/original-texts.md +2 -0
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
# 格拉斯曼流形与 Plücker 嵌入 / Grassmannian and Plücker Embedding
|
|
2
|
+
|
|
3
|
+
## 最小定义
|
|
4
|
+
格拉斯曼流形 $\mathsf{Gr}(k,n)$ 是 $n$ 维向量空间中所有 $k$ 维线性子空间的参数空间,是一个 $k(n-k)$ 维光滑射影簇。它把"子空间"作为几何点参数化,使子空间运算(投影、求交、距离)可表示为几何运算。
|
|
5
|
+
|
|
6
|
+
Plücker 嵌入 $\mathsf{Gr}(k,n)\hookrightarrow\mathbb{P}(\Lambda^k\mathbb{C}^n)$ 把每个子空间 $V=\mathsf{span}(v_1,\ldots,v_k)$ 映射为其基底的外积 $[v_1\wedge\cdots\wedge v_k]$(最高权向量),将子空间表示为射影齐次坐标。这是把几何对象(子空间)转化为代数对象(外代数元素)的标准方式。
|
|
7
|
+
|
|
8
|
+
## 核心公式
|
|
9
|
+
- **格拉斯曼流形定义**:$\mathsf{Gr}(k,n)=\{k\text{-dim subspaces of }\mathbb{C}^n\}$
|
|
10
|
+
- **维数**:$\dim\mathsf{Gr}(k,n)=k(n-k)$
|
|
11
|
+
- **Plücker 嵌入**:$V=\mathsf{span}(v_1,\ldots,v_k)\mapsto[v_1\wedge\cdots\wedge v_k]\in\mathbb{P}(\Lambda^k\mathbb{C}^n)$
|
|
12
|
+
- **Plücker 坐标**:$p_{i_1\cdots i_k}=\det(v_{i_j}^{(i)})$(基底向量在 $i_1,\ldots,i_k$ 行上的子行列式),共 $\binom{n}{k}$ 个
|
|
13
|
+
- **Plücker 关系**(Plücker 坐标满足的二次关系):$\sum_{j=1}^{k+1}(-1)^j p_{i_1\cdots\hat{i_j}\cdots i_{k+1}}\cdot p_{j_1\cdots j_{k-1}i_j}=0$
|
|
14
|
+
- **Schubert 胞腔分解**:$\mathsf{Gr}(k,n)=\bigsqcup_\lambda\Omega_\lambda$(按子空间与固定 flag 的相对位置分层)
|
|
15
|
+
- **Plücker 坐标在低秩时反扩张**:当 $k$ 接近 $n/2$ 时 $\binom{n}{k}$ 急剧膨胀;存基底 $O(Lk)$ 远小于存 Plücker $O(\binom{L}{k})$——这是"低秩时存基底而非 Plücker 坐标"的根本原因
|
|
16
|
+
- **度量**:$\mathsf{Gr}(k,n)$ 上有自然 Riemannian 度量(投影度量),子空间距离 $d(V,W)=\|\sin\Theta\|_F$($\Theta$ 为主角度对角矩阵)
|
|
17
|
+
|
|
18
|
+
## 适用问题
|
|
19
|
+
- **子空间表示压缩**:KV-Cache、LoRA、低秩注意力的子空间参数化——把"存 $L\times d$ 矩阵"转为"存 $k$ 维子空间点"
|
|
20
|
+
- **子空间聚类**:多个低秩子空间的并集表示
|
|
21
|
+
- **表示学习的几何结构分析**:特征空间作为子空间族,度量子空间间距离
|
|
22
|
+
- **特征空间中的距离/度量定义**:用投影度量而非欧氏距离
|
|
23
|
+
- **多模态对齐**:各模态表示子空间的对齐
|
|
24
|
+
- **主角度与主向量**:子空间间的"夹角"作为相似度度量
|
|
25
|
+
|
|
26
|
+
## AI 设计翻译
|
|
27
|
+
- **子空间表示用格拉斯曼点参数化**:把 KV-Cache、LoRA 的低秩子空间作为 $\mathsf{Gr}(k,d)$ 上的点,存基底向量而非完整矩阵
|
|
28
|
+
- **存基底而非 Plücker 坐标避免低秩反扩张**:低秩时 $\binom{d}{k}\gg dk$,存 Plücker 坐标反扩张,存基底(外积向量的因子)更经济
|
|
29
|
+
- **主角度作为子空间相似度**:$d(V,W)=\|\sin\Theta\|_F$ 作为子空间距离,用于多视图对齐
|
|
30
|
+
- 对应设计模式见 `../../design-patterns/compression/low-rank-kv-cache.md`、`../../design-patterns/representation/shared-private-decomposition.md`、`../../design-patterns/representation/subspace-alignment.md`;无对应模式时标为"临时设计翻译"。
|
|
31
|
+
|
|
32
|
+
## 工程可行性
|
|
33
|
+
格拉斯曼流形 GPU 友好度中等:
|
|
34
|
+
- **D1[v]**:子空间由基底矩阵 $V\in\mathbb{R}^{n\times k}$ 表示,完美张量化
|
|
35
|
+
- **D2[v]**:Plücker 坐标计算是外积(小矩阵行列式),可用 batched GEMM
|
|
36
|
+
- **D3[~]**:Plücker 坐标数 $\binom{n}{k}$ 在 $k\approx n/2$ 时爆炸;存基底 $O(nk)$ 远小于存 Plücker $O(\binom{n}{k})$
|
|
37
|
+
- **D4[v]**:存基底 $O(Lk+kd)$ 压缩比高;存 Plücker 坐标反扩张
|
|
38
|
+
- **D5[v]**:正交基底计算(QR)在 bf16 下稳定;Plücker 行列式建议 fp32
|
|
39
|
+
- **D6[v]**:多个子空间点完全并行
|
|
40
|
+
- **D7[~]**:子空间距离计算涉及 SVD(主角度),可用随机化近似
|
|
41
|
+
- **D8[v]**:QR + 外积 + 行列式可融合
|
|
42
|
+
**关键点**:存基底而非 Plücker 坐标;用主角度作为相似度度量;低秩时压缩比取决于 $k/d$ 比
|
|
43
|
+
|
|
44
|
+
## 风险与失效条件
|
|
45
|
+
- **Plücker 坐标在 $k$ 较大时维度爆炸**:$\binom{n}{k}$ 在 $k\approx n/2$ 时达到峰值 $\sim 2^n/\sqrt{n}$,不可存
|
|
46
|
+
- **存 Plücker 而非基底在低秩时反扩张**:这是 `../../design-patterns/compression/low-rank-kv-cache.md` 中明确警告的反模式——低秩时 Plücker 坐标数远大于基底维度
|
|
47
|
+
- **子空间距离定义依赖度量选择**:投影度量、Chordal 度量、Fubini-Study 度量给出不同结果,需明确选择
|
|
48
|
+
- **子空间非唯一表示**:同一子空间可由不同基底表示(基底选择自由),需用等价类或规范形(如 QR 后的正交基)
|
|
49
|
+
- **主角度计算的数值稳定性**:当子空间接近重合时主角度接近 0,$\sin\Theta$ 数值不稳定
|
|
50
|
+
- **Schubert 胞腔分层的选择依赖**:Schubert 分解依赖固定 flag 的选择,不同 flag 给出不同分层
|
|
51
|
+
|
|
52
|
+
## 深入参考
|
|
53
|
+
- 蒸馏稿:`../../references/books/algebraic-geometry-rising-sea.md`
|
|
54
|
+
- 蒸馏稿:`../../references/books/matrix-analysis.md`(§2.6 SVD、主角度)
|
|
55
|
+
- 原书:Ravi Vakil, *The Rising Sea*, Ch on Grassmannians
|
|
56
|
+
- 原书:Horn & Johnson, *Matrix Analysis* 2nd Ed., §2.5 (angles between subspaces)
|
|
57
|
+
|
|
58
|
+
## 路由扩展
|
|
59
|
+
- 若需要低秩近似 → `../matrix-analysis/low-rank-approximation.md`(Eckart-Young、随机化 SVD)
|
|
60
|
+
- 若需要子空间投影 → `../matrix-analysis/projection.md`(正交投影)
|
|
61
|
+
- 若需要矩阵扰动 → `../matrix-analysis/matrix-perturbation.md`(Davis-Kahan 主角度扰动界)
|
|
62
|
+
- 若需要几何视角 → `../../lenses/geometric.md`(度量/曲率)
|
|
63
|
+
- 若需要对称性视角 → `../../lenses/symmetry.md`(GL(n) 作用)
|
|
64
|
+
|
|
65
|
+
## 可扩展方向
|
|
66
|
+
- 量子 Grassmannian(quantum Grassmannian):量子群作用下的 Grassmannian
|
|
67
|
+
- 非交换几何(non-commutative geometry):非交换 Grassmannian
|
|
68
|
+
- Tannakian 重建(Tannakian reconstruction):从表示范畴重建群
|
|
69
|
+
- 模空间参数化(moduli spaces):曲线模空间、矢量丛模空间
|
|
70
|
+
- Hall 代数(Hall algebra):Grassmannian 的 Hall 代数结构
|
|
71
|
+
- 持续 Grassmannian(persistent Grassmannian):结合持续同调的子空间演化
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
# Algebraic Geometry Activation Index
|
|
2
|
+
|
|
3
|
+
## Domain Signals
|
|
4
|
+
Activate this domain when the problem involves:
|
|
5
|
+
- Subspace parameterization: Grassmannian, Plücker embedding, Schubert cells
|
|
6
|
+
- Local-to-global obstruction: sheaves, sheaf cohomology, Čech complex, H^i vanishing criteria
|
|
7
|
+
- Geometric structure diagnosis: algebraic varieties, schemes, morphisms, fiber products, divisors, line bundles
|
|
8
|
+
- Tropical geometry: piecewise-linear gating, tropical semiring, tropical algebra
|
|
9
|
+
- Spectra and cohomology: Hodge decomposition, de Rham cohomology vs sheaf cohomology
|
|
10
|
+
- Categorical structures: functors, natural transformations, Yoneda lemma, Tannakian reconstruction
|
|
11
|
+
|
|
12
|
+
## Core Anchors
|
|
13
|
+
- `sheaf-cohomology.en.md` — Sheaf cohomology (local-to-global obstruction diagnosis, Čech complex)
|
|
14
|
+
- `grassmannian-plucker.en.md` — Grassmannian and Plücker embedding (subspace parameterization)
|
|
15
|
+
|
|
16
|
+
## Extension Concepts
|
|
17
|
+
When core anchors are insufficient, these concepts may require temporary activation:
|
|
18
|
+
- Schemes and morphisms: affine schemes, projective schemes, proper morphism
|
|
19
|
+
- Fiber bundles and vector bundles: sections, connections, curvature
|
|
20
|
+
- Divisors and line bundles: Cartier divisors, Weil divisors, Picard group
|
|
21
|
+
- Hodge theory: Hodge decomposition, Hodge spectral sequence, Calabi-Yau
|
|
22
|
+
- Motives: pure motives, mixed motives, Voevodsky's category
|
|
23
|
+
- Tropical geometry: tropical semiring, tropical polynomials, tropical curves
|
|
24
|
+
- Algebraic groups: linear algebraic groups, Abelian varieties, Picard variety
|
|
25
|
+
- Abelian varieties: Jacobian, Albanese variety
|
|
26
|
+
- Stable maps and Gromov-Witten: moduli spaces, enumerative geometry
|
|
27
|
+
- Characteristic classes: Chern classes, Pontryagin classes, Stiefel-Whitney classes
|
|
28
|
+
- D-modules: differential operators on sheaves, geometric D-module theory
|
|
29
|
+
|
|
30
|
+
## Reference Book Directions
|
|
31
|
+
- `../../references/books/algebraic-geometry-rising-sea.en.md`: Ravi Vakil, *The Rising Sea*, a modern synthesis of algebraic geometry
|
|
32
|
+
- `../../references/books/abstract-algebra.en.md`: Gallian, *Contemporary Abstract Algebra*, algebra foundations (groups/rings/fields)
|
|
33
|
+
- Original book: Ravi Vakil, *The Rising Sea: Foundations of Algebraic Geometry*
|
|
34
|
+
|
|
35
|
+
## AI Translation Directions
|
|
36
|
+
- Sheaf cohomology → local-to-global reasoning on feature fields; H¹ as a multi-view fusion consistency measure
|
|
37
|
+
- Grassmannian → subspace representation compression (KV-Cache, LoRA, low-rank attention's subspace parameterization)
|
|
38
|
+
- Tropical geometry → piecewise-linear gating replacing discrete choice (Top-K → tropical max-plus)
|
|
39
|
+
- Cohomology → structure-obstruction diagnosis (topological obstructions in representation spaces)
|
|
40
|
+
- Schubert cells → subspace stratification and routing
|
|
41
|
+
|
|
42
|
+
## Temporary Activation Rules
|
|
43
|
+
When the required mathematics is not in core anchors:
|
|
44
|
+
1. First check the extension concepts list for a match
|
|
45
|
+
2. If matched, generate a temporary knowledge card using relevant lenses (categorical/local-to-global/topological/spectral/geometric)
|
|
46
|
+
3. If unmatched, enter Knowledge Gap Protocol
|
|
47
|
+
4. Tag the temporary card's domain as "AI" or "shared" for subsequent upgrade
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
# 代数几何 激活索引 / Algebraic Geometry Activation Index
|
|
2
|
+
|
|
3
|
+
## 领域信号
|
|
4
|
+
当问题涉及以下信号时,激活本领域方向:
|
|
5
|
+
- 子空间参数化:格拉斯曼流形、Plücker 嵌入、Schubert 胞腔
|
|
6
|
+
- 局部到整体障碍:层、层的上同调、Čech 复形、H^i 消失判据
|
|
7
|
+
- 几何结构诊断:代数簇、概形、态射、纤维积、除子、线丛
|
|
8
|
+
- 热带几何:分段线性门控、tropical semiring、tropical 代数
|
|
9
|
+
- 谱与上同调:Hodge 分解、de Rham 上同调与层上同调关系
|
|
10
|
+
- 范畴论结构:函子、自然变换、Yoneda 引理、Tannakian 重建
|
|
11
|
+
|
|
12
|
+
## 核心锚点
|
|
13
|
+
- `sheaf-cohomology.md` — 层上同调(局部到整体障碍诊断,Čech 复形)
|
|
14
|
+
- `grassmannian-plucker.md` — 格拉斯曼流形与 Plücker 嵌入(子空间参数化)
|
|
15
|
+
|
|
16
|
+
## 扩展概念
|
|
17
|
+
当核心锚点不够时,以下概念可能需要临时激活:
|
|
18
|
+
- 概形与态射(schemes and morphisms):仿射概形、射影概形、proper morphism
|
|
19
|
+
- 纤维丛与向量丛(fiber bundles and vector bundles):截面、联络、曲率
|
|
20
|
+
- 除子与线丛(divisors and line bundles):Cartier 除子、Weil 除子、Picard 群
|
|
21
|
+
- Hodge 理论(Hodge theory):Hodge 分解、Hodge 谱序列、Calabi-Yau
|
|
22
|
+
- Motives(motives):纯 motive、混合 motive、Voevodsky 的分类
|
|
23
|
+
- 热带几何(tropical geometry):tropical semiring、tropical 多项式、tropical 曲线
|
|
24
|
+
- 代数群(algebraic groups):线性代数群、Abelian 簇、Picard 簇
|
|
25
|
+
- Abelian 簇(abelian varieties):Jacobi 簇、Albanese 簇
|
|
26
|
+
- 稳定映射与 Gromov-Witten(stable maps and Gromov-Witten):模空间、枚举几何
|
|
27
|
+
- 特征类(characteristic classes):Chern 类、Pontryagin 类、Stiefel-Whitney 类
|
|
28
|
+
- 层上的微分算子(D-modules):D-模、微分代数方程的几何
|
|
29
|
+
|
|
30
|
+
## 参考书方向
|
|
31
|
+
- `../../references/books/algebraic-geometry-rising-sea.md`:Ravi Vakil, *The Rising Sea*,代数几何的现代综合
|
|
32
|
+
- `../../references/books/abstract-algebra.md`:Gallian, *Contemporary Abstract Algebra*,代数基础(群/环/域)
|
|
33
|
+
- 原书:Ravi Vakil, *The Rising Sea: Foundations of Algebraic Geometry*
|
|
34
|
+
|
|
35
|
+
## AI 翻译方向
|
|
36
|
+
- 层上同调 → 特征场上的局部到整体推理;H¹ 作为多视图融合一致性度量
|
|
37
|
+
- 格拉斯曼 → 子空间表示压缩(KV-Cache、LoRA、低秩注意力的子空间参数化)
|
|
38
|
+
- 热带几何 → 分段线性门控替代离散选择(Top-K → tropical max-plus)
|
|
39
|
+
- 上同调 → 结构障碍诊断(表示空间中的拓扑障碍)
|
|
40
|
+
- Schubert 胞腔 → 子空间分层与路由
|
|
41
|
+
|
|
42
|
+
## 临时激活规则
|
|
43
|
+
当问题需要的数学不在核心锚点中时:
|
|
44
|
+
1. 先检查扩展概念中是否有匹配
|
|
45
|
+
2. 若有,根据透镜(categorical/local-to-global/topological/spectral/geometric)生成临时知识卡
|
|
46
|
+
3. 若无,进入 Knowledge Gap Protocol
|
|
47
|
+
4. 临时卡标注 domain 为 "AI" 或 "shared",便于后续升级
|
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
# Sheaf Cohomology
|
|
2
|
+
|
|
3
|
+
## Minimal Definition
|
|
4
|
+
A sheaf $\mathcal{F}$ assigns an algebraic structure (group/ring/vector space) $\mathcal{F}(U)$ to each open set $U$ of a topological space, subject to local-to-global gluing rules. Concretely:
|
|
5
|
+
- **Local sections**: $\mathcal{F}(U)$ is the set of "local solutions" on $U$
|
|
6
|
+
- **Sheaf axiom (gluing)**: if $\{U_i\}$ is an open cover of $U$ and $s_i\in\mathcal{F}(U_i)$ agree on overlaps $U_i\cap U_j$, then there exists a unique $s\in\mathcal{F}(U)$ restricting to each $s_i$
|
|
7
|
+
|
|
8
|
+
Sheaf cohomology $H^i(X,\mathcal{F})$ measures local-to-global obstructions finer than the section-gluing axiom itself — for example extension classes, principal-bundle classification, or higher gluing problems. The first cohomology $H^1$ is the most commonly used obstruction diagnostic; Čech cohomology, computed via the intersection complex of an open cover, is the most commonly used approximate form in engineering.
|
|
9
|
+
|
|
10
|
+
## Core Formulas
|
|
11
|
+
- **Sheaf condition (gluing axiom)**: $\mathcal{F}(U)\to\prod_i\mathcal{F}(U_i)\rightrightarrows\prod_{i,j}\mathcal{F}(U_i\cap U_j)$ is an equalizer
|
|
12
|
+
- **Čech complex**: $C^p(\mathcal{U},\mathcal{F})=\prod_{i_0<\cdots<i_p}\mathcal{F}(U_{i_0\cdots i_p})$, differential $d^p:C^p\to C^{p+1}$ formed from restriction maps
|
|
13
|
+
- **Cohomology groups**: $H^i(X,\mathcal{F})=\ker d^i/\mathsf{im}\,d^{i-1}$
|
|
14
|
+
- **Meaning of $H^1=0$**: For many extension, principal-bundle, or gluing-obstruction problems, $H^1$ measures whether local data can be lifted to a global object. Note: a true sheaf already guarantees by the gluing axiom that “sections agreeing on overlaps ⇒ a unique global section,” so $H^1=0$ must not be stated as a blanket necessary-and-sufficient condition for arbitrary “local consistency ⇒ global consistency.” Engineering diagnoses should first specify which cohomology problem is being measured.
|
|
15
|
+
- **Spectral sequence (Leray)**: $E_2^{p,q}=H^p(\mathcal{U},\mathcal{H}^q)$ converges to $H^{p+q}(X,\mathcal{F})$, computing higher cohomology
|
|
16
|
+
- **Relation to de Rham cohomology**: $H^i_{\mathsf{dR}}(X)\cong H^i(X,\Omega_X^{\bullet})$, de Rham cohomology is a special case of sheaf cohomology
|
|
17
|
+
- **Vanishing theorems** (Cartan Theorem A/B, Serre): on affine varieties, coherent sheaf cohomology $H^i=0$ for $i>0$; on projective space, line bundle $\mathcal{O}(d)$ has $H^i$ vanishing for certain $d$ ranges
|
|
18
|
+
|
|
19
|
+
## Applicable Problems
|
|
20
|
+
- Diagnosing "locally consistent but globally obstructed" structures:
|
|
21
|
+
- **Multi-view feature alignment**: each view locally aligns, but global alignment fails — $H^1$ measures the alignment obstruction
|
|
22
|
+
- **Multi-modal fusion inconsistency**: each modality's local information is consistent, but global fusion has contradictions
|
|
23
|
+
- **Distributed training global consistency**: each node's local gradients agree, but global aggregation has obstructions
|
|
24
|
+
- **Topological obstructions in representation space**: "holes" or "loops" in feature space affect downstream tasks
|
|
25
|
+
- Model diagnosis: detecting structural obstructions in representation spaces (nontrivial $H^1$)
|
|
26
|
+
- Knowledge graph reasoning: local consistency of entity relations vs global contradictions
|
|
27
|
+
|
|
28
|
+
## AI Design Translation
|
|
29
|
+
- **Sheaf cohomology as a "local-to-global obstruction diagnostician"**: model multi-view / multi-modal / multi-node local consistency as sheaf sections, with $H^1$ as a formal measure of fusion failure
|
|
30
|
+
- **H¹ as a multi-view fusion consistency measure**: define a sheaf on multi-view features, compute Čech cohomology, $H^1=0$ means fusable, $H^1\ne 0$ means obstructed
|
|
31
|
+
- **Persistent sheaf cohomology**: combine persistent homology with sheaf cohomology as a topological diagnostic for representation spaces
|
|
32
|
+
- See `../../design-patterns/compression/topology-preserving-compression.en.md`, `../../design-patterns/representation/shared-private-decomposition.en.md` for corresponding patterns; if no match, label as "temporary design translation."
|
|
33
|
+
|
|
34
|
+
## Engineering Feasibility
|
|
35
|
+
Sheaf cohomology has severe GPU-friendliness challenges:
|
|
36
|
+
- **D1[x]**: exact Čech cohomology requires constructing open covers + computing high-order intersection complexes, non-tensorizable
|
|
37
|
+
- **D2[x]**: boundary matrix reduction is highly serial, not GEMM-mappable
|
|
38
|
+
- **D3[x]**: exact Čech cohomology starts at $O(N^3)$, $N$ being the open-cover size; higher cohomology $O(N^{p+3})$
|
|
39
|
+
- **D4[~]**: can be reduced to landmark sampling $O(m^3)$, $m\ll N$; but still not GPU-friendly
|
|
40
|
+
- **D5[v]**: integer arithmetic (boundary matrices) has no precision issues; floating-point approximations can use bf16
|
|
41
|
+
- **D6[x]**: reduction algorithms are highly serial; landmark selection can be parallelized
|
|
42
|
+
- **D7[~]**: sparse boundary matrices can be stored in CSR; SpMM is effective but reduction remains serial
|
|
43
|
+
- **D8[x]**: boundary matrix reduction is not fusable
|
|
44
|
+
**Key retrofit**: use landmark sampling $O(m^3)$ instead of full $O(N^3)$; use approximate persistent homology versions; use Euler curves as proxies; **exact cohomology should not be inserted into training loops**, only as diagnostics or regularization.
|
|
45
|
+
|
|
46
|
+
## Risks and Failure Conditions
|
|
47
|
+
- **Exact cohomology is uncomputable**: $O(N^3)$ serial algorithms are infeasible for $N>10^4$; approximations are mandatory
|
|
48
|
+
- **Čech approximation depends on cover choice**: open-cover selection affects results; different covers give different $H^i$; landmark selection may introduce bias
|
|
49
|
+
- **Wrong sheaf parameterization distorts cohomology**: if the sheaf $\mathcal{F}$'s sections are defined incorrectly, $H^i$ loses diagnostic meaning
|
|
50
|
+
- **$H^1=0$ does not guarantee higher-order obstruction-free**: $H^1=0$ only guarantees local solutions can be glued globally, but $H^2$ and above may still be obstructed
|
|
51
|
+
- **Euler curve information loss**: $\chi=\sum(-1)^k\beta_k$ compresses multiple orders into a single value; different topologies can share the same $\chi$
|
|
52
|
+
- **Topology ≠ semantics**: topological preservation is not semantic preservation; two semantically different spaces may be topologically isomorphic
|
|
53
|
+
- **Cohomology base-field sensitivity**: $\mathbb{Z}$ coefficients vs $\mathbb{R}$ vs $\mathbb{F}_p$ give different torsion information
|
|
54
|
+
|
|
55
|
+
## Further References
|
|
56
|
+
- Distilled notes: `../../references/books/algebraic-geometry-rising-sea.en.md`
|
|
57
|
+
- Original book: Ravi Vakil, *The Rising Sea: Foundations of Algebraic Geometry*, Ch 18-22 (sheaves and cohomology)
|
|
58
|
+
- Original book: Robin Hartshorne, *Algebraic Geometry*, Ch III (Cohomology)
|
|
59
|
+
|
|
60
|
+
## Routing Extensions
|
|
61
|
+
- If local-to-global is needed → `../../lenses/local-to-global.en.md` (assembling local properties into global)
|
|
62
|
+
- If topological diagnosis is needed → `../topology/persistent-homology.en.md` (persistent homology, Betti numbers)
|
|
63
|
+
- If categorical language is needed → `../../lenses/categorical.en.md` (sheaves are a core categorical construct)
|
|
64
|
+
- If Euler characteristic is needed → `../topology/euler-characteristic.en.md` (fast topological diagnostic proxy)
|
|
65
|
+
|
|
66
|
+
## Extensible Directions
|
|
67
|
+
- Derived functors: $\mathsf{Ext}^i$, $\mathsf{Tor}_i$ as derived functors
|
|
68
|
+
- Spectral sequences: Leray, Grothendieck, Atiyah-Hirzebruch
|
|
69
|
+
- Hodge decomposition: cohomology of algebraic varieties over $\mathbb{C}$
|
|
70
|
+
- D-modules: differential operator theory on sheaves
|
|
71
|
+
- Picard group: isomorphism classes of line bundles, $H^1(X,\mathcal{O}^{\times})$
|
|
72
|
+
- Persistent sheaf cohomology: combining persistent homology with sheaf cohomology
|
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
# 层上同调 / Sheaf Cohomology
|
|
2
|
+
|
|
3
|
+
## 最小定义
|
|
4
|
+
层 $\mathcal{F}$ 是给拓扑空间每个开集 $U$ 赋一个代数结构(群/环/向量空间)$\mathcal{F}(U)$ 并满足局部到整体粘合规则的对象。具体地:
|
|
5
|
+
- **局部截面**:$\mathcal{F}(U)$ 是 $U$ 上的"局部解"集合
|
|
6
|
+
- **粘合公理(sheaf axiom)**:若 $\{U_i\}$ 是 $U$ 的开覆盖,且 $s_i\in\mathcal{F}(U_i)$ 在交叠 $U_i\cap U_j$ 上一致,则存在唯一 $s\in\mathcal{F}(U)$ 限制到每个 $U_i$ 为 $s_i$
|
|
7
|
+
|
|
8
|
+
层上同调 $H^i(X,\mathcal{F})$ 度量比“截面粘合公理”更细的局部到整体障碍——例如扩张类、主丛分类或高阶粘合问题。一阶上同调 $H^1$ 是最常用的障碍诊断量;Čech 上同调用开覆盖的交并复形计算,是工程上最常用的近似形式。
|
|
9
|
+
|
|
10
|
+
## 核心公式
|
|
11
|
+
- **层条件**(粘合公理):$\mathcal{F}(U)\to\prod_i\mathcal{F}(U_i)\rightrightarrows\prod_{i,j}\mathcal{F}(U_i\cap U_j)$ 是等化子
|
|
12
|
+
- **Čech 复形**:$C^p(\mathcal{U},\mathcal{F})=\prod_{i_0<\cdots<i_p}\mathcal{F}(U_{i_0\cdots i_p})$,微分 $d^p:C^p\to C^{p+1}$ 由限制映射构成
|
|
13
|
+
- **上同调群**:$H^i(X,\mathcal{F})=\ker d^i/\mathsf{im}\,d^{i-1}$
|
|
14
|
+
- **$H^1=0$ 的含义**:对许多扩张、主丛或粘合障碍问题,$H^1$ 刻画局部数据能否升成全局对象。注意:真层本身已由粘合公理保证“交叠一致的截面 ⇒ 唯一全局截面”,因此不能把 $H^1=0$ 笼统写成任意“局部一致 ⇒ 全局一致”的充要条件;工程诊断应先写清所测障碍对应哪一类上同调问题。
|
|
15
|
+
- **谱序列(Leray)**:$E_2^{p,q}=H^p(\mathcal{U},\mathcal{H}^q)$ 收敛到 $H^{p+q}(X,\mathcal{F})$,计算高阶上同调
|
|
16
|
+
- **与 de Rham 上同调关系**:$H^i_{\mathsf{dR}}(X)\cong H^i(X,\Omega_X^{\bullet})$,de Rham 上同调是层上同调的特例
|
|
17
|
+
- **消失定理**(Cartan Theorem A/B、Serre):仿射簇上凝聚层的 $H^i=0$($i>0$);投影空间上线丛 $\mathcal{O}(d)$ 的 $H^i$ 在某些 $d$ 范围消失
|
|
18
|
+
|
|
19
|
+
## 适用问题
|
|
20
|
+
- 诊断"局部数据一致但全局存在障碍"的结构:
|
|
21
|
+
- **多视图特征对齐**:各视图局部对齐一致,但全局对齐失败——$H^1$ 度量对齐障碍
|
|
22
|
+
- **多模态融合不一致性**:各模态局部信息一致,全局融合存在矛盾
|
|
23
|
+
- **分布式训练的全局一致性**:各节点局部梯度一致,但全局聚合存在障碍
|
|
24
|
+
- **表示空间中的拓扑障碍**:特征空间的"洞"或"环"影响下游任务
|
|
25
|
+
- 模型诊断:检测表示空间是否存在结构性障碍(非平凡 $H^1$)
|
|
26
|
+
- 知识图谱推理:实体关系的局部一致 vs 全局矛盾
|
|
27
|
+
|
|
28
|
+
## AI 设计翻译
|
|
29
|
+
- **层上同调作为"局部到整体障碍诊断器"**:把多视图 / 多模态 / 多节点局部一致性建模为层截面,$H^1$ 作为融合失败的形式化度量
|
|
30
|
+
- **H¹ 作为多视图融合一致性度量**:对多视图特征定义层,计算 Čech 上同调,$H^1=0$ 表示可融合,$H^1\ne 0$ 表示存在障碍
|
|
31
|
+
- **持续层上同调(persistent sheaf cohomology)**:结合持续同调与层上同调,作为表示空间的拓扑诊断
|
|
32
|
+
- 对应设计模式见 `../../design-patterns/compression/topology-preserving-compression.md`、`../../design-patterns/representation/shared-private-decomposition.md`;无对应模式时标为"临时设计翻译"。
|
|
33
|
+
|
|
34
|
+
## 工程可行性
|
|
35
|
+
层上同调 GPU 友好度挑战很大:
|
|
36
|
+
- **D1[x]**:精确 Čech 上同调需要构造开覆盖 + 计算高阶交并复形,非张量化
|
|
37
|
+
- **D2[x]**:边界矩阵约化高度串行,不可 GEMM 化
|
|
38
|
+
- **D3[x]**:精确 Čech 上同调 $O(N^3)$ 起步,$N$ 为开覆盖规模;高阶上同调 $O(N^{p+3})$
|
|
39
|
+
- **D4[~]**:可降维到 landmark 采样 $O(m^3)$,$m\ll N$;但仍非 GPU 友好
|
|
40
|
+
- **D5[v]**:整数运算(边界矩阵)无精度问题;浮点近似可 bf16
|
|
41
|
+
- **D6[x]**:约化算法高度串行;landmark 选择可并行
|
|
42
|
+
- **D7[~]**:稀疏边界矩阵可 CSR 存储;SpMM 有效但约化仍串行
|
|
43
|
+
- **D8[x]**:边界矩阵约化不可融合
|
|
44
|
+
**关键改造**:用 landmark 采样 $O(m^3)$ 替代全量 $O(N^3)$;用持续同调的近似版本;用 Euler curve 作代理;**精确同调不应塞进训练循环**,只作为诊断或正则项。
|
|
45
|
+
|
|
46
|
+
## 风险与失效条件
|
|
47
|
+
- **精确同调不可算**:$O(N^3)$ 串行算法在 $N>10^4$ 时不可行,必须依赖近似
|
|
48
|
+
- **Čech 近似依赖覆盖选择**:开覆盖的选取影响结果,不同覆盖给出不同 $H^i$;landmark 选择可能引入偏差
|
|
49
|
+
- **层结构错误参数化导致上同调失真**:若层 $\mathcal{F}$ 的截面定义错误,$H^i$ 失去诊断意义
|
|
50
|
+
- **$H^1=0$ 不保证高阶无障碍**:$H^1=0$ 只保证局部解可全局粘合,但 $H^2$ 及以上可能有障碍
|
|
51
|
+
- **Euler curve 信息退化**:$\chi=\sum(-1)^k\beta_k$ 把多阶压成单值,不同拓扑可共享同一 $\chi$
|
|
52
|
+
- **拓扑 ≠ 语义**:拓扑保持不等于语义保持;两个语义不同的空间可能拓扑同构
|
|
53
|
+
- **上同调基域选择敏感**:$\mathbb{Z}$ 系数 vs $\mathbb{R}$ 系数 vs $\mathbb{F}_p$ 系数给出不同的 torsion 信息
|
|
54
|
+
|
|
55
|
+
## 深入参考
|
|
56
|
+
- 蒸馏稿:`../../references/books/algebraic-geometry-rising-sea.md`
|
|
57
|
+
- 原书:Ravi Vakil, *The Rising Sea: Foundations of Algebraic Geometry*, Ch 18-22(层与上同调)
|
|
58
|
+
- 原书:Robin Hartshorne, *Algebraic Geometry*, Ch III(Cohomology)
|
|
59
|
+
|
|
60
|
+
## 路由扩展
|
|
61
|
+
- 若需要局部到整体 → `../../lenses/local-to-global.md`(局部性质拼接为全局)
|
|
62
|
+
- 若需要拓扑诊断 → `../topology/persistent-homology.md`(持续同调、Betti 数)
|
|
63
|
+
- 若需要范畴论语言 → `../../lenses/categorical.md`(层是范畴论的核心构造)
|
|
64
|
+
- 若需要欧拉示性数 → `../topology/euler-characteristic.md`(快速拓扑诊断代理)
|
|
65
|
+
|
|
66
|
+
## 可扩展方向
|
|
67
|
+
- 导出函子(derived functors):$\mathsf{Ext}^i$、$\mathsf{Tor}_i$ 作为导出函子
|
|
68
|
+
- 谱序列(spectral sequences):Leray、Grothendieck、Atiyah-Hirzebruch
|
|
69
|
+
- Hodge 分解(Hodge decomposition):$\mathbb{C}$ 上的代数簇上同调分解
|
|
70
|
+
- D-模(D-modules):层上的微分算子理论
|
|
71
|
+
- 皮卡群(Picard group):线丛的同构类群,$H^1(X,\mathcal{O}^{\times})$
|
|
72
|
+
- 持续层上同调(persistent sheaf cohomology):持续同调与层上同调的结合
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# Attack-Game Framework
|
|
2
|
+
|
|
3
|
+
## Minimal Definition
|
|
4
|
+
|
|
5
|
+
An attack game is a probabilistic interaction between a challenger and an adversary that specifies a security goal, adversarial capabilities, and a winning event. Security usually means that every adversary within the stated resource class has negligible asymptotic advantage or an explicitly small concrete advantage.
|
|
6
|
+
|
|
7
|
+
An encryption indistinguishability game is only one instance. Signatures, MACs, commitments, and zero knowledge use different oracles, restrictions, and winning conditions; they cannot all be forced into one “submit two messages and guess a bit” script.
|
|
8
|
+
|
|
9
|
+
## Core Formulas
|
|
10
|
+
|
|
11
|
+
- Two-experiment advantage:
|
|
12
|
+
$$\operatorname{Adv}_A=\left|\Pr[A\text{ outputs }1\text{ in experiment }0]-\Pr[A\text{ outputs }1\text{ in experiment }1]\right|.$$
|
|
13
|
+
- Bit-guess games commonly use $|\Pr[b'=b]-1/2|$ or twice this quantity. Align conventions before comparing bounds.
|
|
14
|
+
- Difference lemma: if two games can diverge only after event `bad`,
|
|
15
|
+
$$|\Pr[W_0]-\Pr[W_1]|\le \Pr[\mathsf{bad}].$$
|
|
16
|
+
- For $q$ uniform $n$-bit samples, the collision union bound is $q(q-1)/2^{n+1}$; $q^2/2^n$ is only an order-level shorthand.
|
|
17
|
+
|
|
18
|
+
## Applicable Problems
|
|
19
|
+
|
|
20
|
+
- Formalize IND-CPA/CCA, EUF-CMA, PRF, binding/hiding, and related properties.
|
|
21
|
+
- Specify encryption, decryption, signing, verification, random-oracle, or leakage interfaces.
|
|
22
|
+
- Check post-challenge restrictions, freshness, multi-user effects, and adaptive corruption.
|
|
23
|
+
- Rewrite a proof as a game sequence and track advantage loss at each transition.
|
|
24
|
+
|
|
25
|
+
## Cryptographic Construction and Cross-Domain Boundary
|
|
26
|
+
|
|
27
|
+
- AI security can borrow the discipline of explicitly defining the adversary, interface, budget, and winning event. It must not simply rename CPA/CCA as black-box/white-box attacks.
|
|
28
|
+
- Perturbation sets, data distributions, and error rates in ML are generally not negligible functions. Use task-appropriate risks or certified radii rather than mechanically requiring $\operatorname{negl}(n)$.
|
|
29
|
+
- Load cryptographic oracle details only when the AI construction actually uses a primitive or claims a cryptographic property.
|
|
30
|
+
|
|
31
|
+
## Implementation Considerations
|
|
32
|
+
|
|
33
|
+
- A game is a definition. Finite tests can find implementation deviations but cannot prove negligible advantage against every PPT adversary.
|
|
34
|
+
- Concrete-security reports should state the security parameter, queries, time/memory, user count, and all failure events.
|
|
35
|
+
- Randomness, state reset, challenge freshness, and forbidden-query logic must match between implementation and proof.
|
|
36
|
+
|
|
37
|
+
## Risks and Failure Conditions
|
|
38
|
+
|
|
39
|
+
- **Weak adversary model:** Missing interfaces, leakage, or adaptivity proves security in the wrong game.
|
|
40
|
+
- **Mixed advantage conventions:** $|p-1/2|$ and $2|p-1/2|$ differ by a factor of two.
|
|
41
|
+
- **Asymptotic/concrete confusion:** Negligibility does not itself establish sufficient strength at fixed parameters.
|
|
42
|
+
- **Incorrect challenge restrictions:** Too little restriction trivializes the game; too much inflates security.
|
|
43
|
+
- **Testing as proof:** Failure to find an attack is evidence only against the tested adversaries.
|
|
44
|
+
|
|
45
|
+
## Further References
|
|
46
|
+
|
|
47
|
+
- `../../references/books/applied-cryptography.md`
|
|
48
|
+
- `../../references/books/foundations-of-cryptography.md`
|
|
49
|
+
- `../../references/books/introduction-to-modern-cryptography.md`
|
|
50
|
+
|
|
51
|
+
## Routing Extensions
|
|
52
|
+
|
|
53
|
+
- Reductions: `reduction-proof-template.en.md`
|
|
54
|
+
- CPA/CCA/AE: `cca-cpa-ae-hierarchy.en.md`
|
|
55
|
+
- PRF: `prf-prg-owf.en.md`
|
|
56
|
+
- Probability bounds: `../probability/concentration-inequality.en.md`
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# 攻击游戏框架 / Attack-Game Framework
|
|
2
|
+
|
|
3
|
+
## 最小定义
|
|
4
|
+
|
|
5
|
+
攻击游戏是挑战者与敌手之间的概率交互实验,用来精确定义安全目标、敌手能力和胜利事件。方案安全通常表示:对所有给定资源界内的敌手,其优势可忽略(渐近安全)或小于明确数值(具体安全)。
|
|
6
|
+
|
|
7
|
+
加密的 indistinguishability game 只是一个实例;签名、MAC、承诺和零知识各有不同 oracle、限制与胜利条件,不能统一套用“提交两条消息、猜 bit”的固定流程。
|
|
8
|
+
|
|
9
|
+
## 核心公式
|
|
10
|
+
|
|
11
|
+
- 双实验优势:
|
|
12
|
+
$$\operatorname{Adv}_A=\left|\Pr[A\text{ 在实验 }0\text{ 输出 }1]-\Pr[A\text{ 在实验 }1\text{ 输出 }1]\right|.$$
|
|
13
|
+
- 猜 bit 游戏常用 $\left|\Pr[b'=b]-\tfrac12\right|$ 或其两倍。比较论文时必须先对齐 convention。
|
|
14
|
+
- 序列游戏/Difference Lemma:若两游戏只在事件 `bad` 后可能分歧,则
|
|
15
|
+
$$\left|\Pr[W_0]-\Pr[W_1]\right|\le \Pr[\mathsf{bad}].$$
|
|
16
|
+
- $q$ 个均匀 $n$-bit 样本发生碰撞的 union bound 为 $q(q-1)/2^{n+1}$;“$q^2/2^n$”只是量级写法。
|
|
17
|
+
|
|
18
|
+
## 适用问题
|
|
19
|
+
|
|
20
|
+
- 为 IND-CPA/CCA、EUF-CMA、PRF、binding/hiding 等性质写正式游戏。
|
|
21
|
+
- 比较敌手是否拥有加密、解密、签名、验证、随机预言机或状态泄露接口。
|
|
22
|
+
- 检查挑战后的禁止查询、freshness、multi-user、adaptive corruption 等细节。
|
|
23
|
+
- 将证明改写成游戏序列并跟踪每一步优势损失。
|
|
24
|
+
|
|
25
|
+
## 密码学构造与跨域边界
|
|
26
|
+
|
|
27
|
+
- 游戏框架可以迁移到 AI 安全定义,但只能迁移“显式写敌手、接口、预算和胜利事件”的方法,不能把 CPA/CCA 名称直接重命名为黑盒/白盒攻击。
|
|
28
|
+
- ML 鲁棒性中的扰动集、数据分布和错误率一般不是可忽略函数;应使用与任务匹配的风险或认证半径,而非机械要求 $\operatorname{negl}(n)$。
|
|
29
|
+
- 只有当 AI 方案实际调用密码学原语或声称密码学安全性质时,才加载本卡的密码学 oracle 细节。
|
|
30
|
+
|
|
31
|
+
## 实现注意事项
|
|
32
|
+
|
|
33
|
+
- 游戏是定义;测试代码只能发现实现偏差,不能以有限样本证明所有 PPT 敌手优势可忽略。
|
|
34
|
+
- 具体安全报告应列出安全参数、查询数、时间/内存资源、多用户数和所有失败事件。
|
|
35
|
+
- 随机数、状态重置、challenge freshness 和禁止查询条件必须在实现与证明中一致。
|
|
36
|
+
|
|
37
|
+
## 风险与失效条件
|
|
38
|
+
|
|
39
|
+
- **敌手模型过弱**:遗漏接口、泄露或自适应能力会得到“在错误游戏里安全”的结论。
|
|
40
|
+
- **优势 convention 混用**:$|p-1/2|$ 与 $2|p-1/2|$ 相差 2,可能破坏具体参数计算。
|
|
41
|
+
- **渐近与具体安全混淆**:可忽略函数并不自动说明固定参数下足够安全。
|
|
42
|
+
- **挑战限制漏写**:允许直接查询挑战对象会使游戏平凡;限制过强又会人为抬高安全性。
|
|
43
|
+
- **把经验攻击失败当证明**:未找到攻击只给出对已测试敌手的证据。
|
|
44
|
+
|
|
45
|
+
## 深入参考
|
|
46
|
+
|
|
47
|
+
- `../../references/books/applied-cryptography.md`
|
|
48
|
+
- `../../references/books/foundations-of-cryptography.md`
|
|
49
|
+
- `../../references/books/introduction-to-modern-cryptography.md`
|
|
50
|
+
|
|
51
|
+
## 路由扩展
|
|
52
|
+
|
|
53
|
+
- 归约:`reduction-proof-template.md`
|
|
54
|
+
- CPA/CCA/AE:`cca-cpa-ae-hierarchy.md`
|
|
55
|
+
- PRF:`prf-prg-owf.md`
|
|
56
|
+
- 概率界:`../probability/concentration-inequality.md`
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
# Encryption Security Hierarchy: CPA, CCA, and AE
|
|
2
|
+
|
|
3
|
+
## Minimal Definition
|
|
4
|
+
|
|
5
|
+
- **IND-CPA:** Even with encryption-oracle access, an adversary cannot distinguish the challenge encryptions of two equal-length messages.
|
|
6
|
+
- **IND-CCA1:** A decryption oracle is available before, but not after, the challenge.
|
|
7
|
+
- **IND-CCA2:** A decryption oracle is available before and after the challenge, except on the challenge ciphertext itself and any variants excluded by the definition.
|
|
8
|
+
- **INT-CTXT:** The adversary cannot produce a fresh valid ciphertext not previously returned by the encryption oracle.
|
|
9
|
+
- **Authenticated encryption (AE):** Provides confidentiality and ciphertext integrity. A common formulation uses IND-CPA + INT-CTXT and implies the corresponding CCA confidentiality; exact AE/AEAD games vary by source.
|
|
10
|
+
|
|
11
|
+
This is a common hierarchy, not a claim that IND-CCA2 is the strongest possible notion for every protocol.
|
|
12
|
+
|
|
13
|
+
## Core Formulas
|
|
14
|
+
|
|
15
|
+
- IND advantage is written as $|\Pr[b'=b]-1/2|$ or twice this quantity, depending on convention.
|
|
16
|
+
- Typical implications: IND-CCA2 $\Rightarrow$ IND-CCA1 $\Rightarrow$ IND-CPA; converses fail in general.
|
|
17
|
+
- With independent keys and suitable primitive assumptions, Encrypt-then-MAC (EtM) is a generic route to AE.
|
|
18
|
+
- MAC-then-Encrypt and Encrypt-and-MAC are **not unconditionally insecure**. They lack EtM's broad generic composition theorem; security depends on the encryption/MAC, encoding, error handling, and leakage model.
|
|
19
|
+
- For perfect secrecy over finite message spaces, the key space/entropy must cover the message uncertainty; in the common uniform finite case $|\mathcal K|\ge|\mathcal M|$. This is not a general key-length formula for computational security.
|
|
20
|
+
|
|
21
|
+
## Applicable Problems
|
|
22
|
+
|
|
23
|
+
- Select confidentiality and integrity goals for encryption, KEM-DEM, record, or storage protocols.
|
|
24
|
+
- Determine whether decryption oracles, errors, and replay interfaces strengthen the adversary.
|
|
25
|
+
- Review EtM/AEAD key separation, nonce handling, and associated-data binding.
|
|
26
|
+
- Check whether a paper's CPA/CCA/AE claim matches its actual API.
|
|
27
|
+
|
|
28
|
+
## Cryptographic Construction and Cross-Domain Boundary
|
|
29
|
+
|
|
30
|
+
- CPA/CCA describe encryption-oracle capabilities; they are not synonyms for black-box/white-box/gradient access in ML.
|
|
31
|
+
- Correctness, unforgeability, and privacy are distinct. Verifiable inference should define soundness, zero knowledge/privacy, and authentication separately rather than calling all of them AE.
|
|
32
|
+
- EtM cannot be transferred to an arbitrary ML pipeline merely as “verify before/after inference.” First define the authenticated bytes, parsing behavior, and failure side channels.
|
|
33
|
+
|
|
34
|
+
## Implementation Considerations
|
|
35
|
+
|
|
36
|
+
- Prefer standardized AEAD APIs. Meet each scheme's random/unique nonce requirement and bind protocol context as associated data.
|
|
37
|
+
- Derive separate encryption and authentication keys; verify the tag before releasing plaintext and unify error behavior.
|
|
38
|
+
- CCA security does not itself prevent replay, traffic analysis, endpoint compromise, or side channels.
|
|
39
|
+
|
|
40
|
+
## Risks and Failure Conditions
|
|
41
|
+
|
|
42
|
+
- **Treating implication as equivalence:** IND-CPA does not imply IND-CCA; confidentiality does not imply integrity.
|
|
43
|
+
- **Judging composition from initials alone:** MtE/EaM security depends on the concrete construction.
|
|
44
|
+
- **Nonce/key reuse:** Many AEAD schemes lose confidentiality and integrity under nonce reuse.
|
|
45
|
+
- **Decryption error side channels:** Distinct padding/tag/parsing failures can become an oracle.
|
|
46
|
+
- **Invalid perfect-secrecy analogy:** $|\mathcal K|\ge|\mathcal M|$ does not mean training-data size must exceed model-parameter count.
|
|
47
|
+
|
|
48
|
+
## Further References
|
|
49
|
+
|
|
50
|
+
- `../../references/books/applied-cryptography.md`
|
|
51
|
+
- `../../references/books/introduction-to-modern-cryptography.md`
|
|
52
|
+
|
|
53
|
+
## Routing Extensions
|
|
54
|
+
|
|
55
|
+
- Games: `attack-game-framework.en.md`
|
|
56
|
+
- Reductions: `reduction-proof-template.en.md`
|
|
57
|
+
- PRF: `prf-prg-owf.en.md`
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
# 加密安全层级:CPA、CCA 与 AE
|
|
2
|
+
|
|
3
|
+
## 最小定义
|
|
4
|
+
|
|
5
|
+
- **IND-CPA**:敌手可获得加密 oracle,并不能区分两条等长消息的挑战密文。
|
|
6
|
+
- **IND-CCA1**:挑战前可查询解密 oracle,挑战后不可。
|
|
7
|
+
- **IND-CCA2**:挑战前后均可查询解密 oracle,但禁止提交挑战密文本身(及定义规定的等价变体)。
|
|
8
|
+
- **INT-CTXT**:敌手不能产生未由加密 oracle 返回过、但能通过解密验证的新密文。
|
|
9
|
+
- **认证加密(AE)**:同时提供机密性与密文完整性。常见形式化采用 IND-CPA + INT-CTXT,并可推出相应的 CCA 机密性;不同文献的 AE/AEAD 游戏需对齐。
|
|
10
|
+
|
|
11
|
+
这是常用层级,不表示 IND-CCA2 是所有协议场景中“最强可能”的安全定义。
|
|
12
|
+
|
|
13
|
+
## 核心公式
|
|
14
|
+
|
|
15
|
+
- IND 优势按采用的 convention 写为 $|\Pr[b'=b]-1/2|$ 或其两倍。
|
|
16
|
+
- 典型蕴含:IND-CCA2 $\Rightarrow$ IND-CCA1 $\Rightarrow$ IND-CPA;逆向一般不成立。
|
|
17
|
+
- 在独立密钥和合适原语假设下,Encrypt-then-MAC(EtM)是构造 AE 的通用方法。
|
|
18
|
+
- MAC-then-Encrypt 和 Encrypt-and-MAC **不是无条件不安全**;它们缺少与 EtM 同样宽泛的通用合成定理,具体安全性取决于加密/MAC、编码、错误处理和泄露模型。
|
|
19
|
+
- 对有限消息空间的完美保密,密钥空间/熵必须足以覆盖消息不确定性;常见均匀有限情形给出 $|\mathcal K|\ge|\mathcal M|$。这不是计算安全方案的一般密钥长度公式。
|
|
20
|
+
|
|
21
|
+
## 适用问题
|
|
22
|
+
|
|
23
|
+
- 为加密、KEM-DEM、记录层或存储协议选择机密性与完整性目标。
|
|
24
|
+
- 检查解密 oracle、错误信息和重放接口是否升级了敌手能力。
|
|
25
|
+
- 审查 EtM/AEAD 的 key separation、nonce 和 associated data 绑定。
|
|
26
|
+
- 判断论文声称的 CPA/CCA/AE 是否与实际 API 一致。
|
|
27
|
+
|
|
28
|
+
## 密码学构造与跨域边界
|
|
29
|
+
|
|
30
|
+
- CPA/CCA 描述的是加密 oracle 能力,不等同于 ML 的黑盒/白盒/梯度访问层级。
|
|
31
|
+
- “输出正确”“不可伪造”“保密”是不同性质;可验证推理若需要密码学保证,应分别定义 soundness、zero knowledge/privacy 和 authentication,而不是统称 AE。
|
|
32
|
+
- EtM 的经验不能按“先校验后推理/先推理后校验”的文字顺序直接迁移到任意 ML pipeline;必须先定义被认证的字节串、解析行为与失败侧信道。
|
|
33
|
+
|
|
34
|
+
## 实现注意事项
|
|
35
|
+
|
|
36
|
+
- 优先使用标准 AEAD API,保证 nonce 按方案要求唯一或随机,并把协议上下文绑定为 associated data。
|
|
37
|
+
- 独立派生加密与认证密钥;验证 tag 后再释放明文,错误路径保持统一。
|
|
38
|
+
- CCA 安全不自动解决重放、流量分析、端点泄露或侧信道,需要协议层机制。
|
|
39
|
+
|
|
40
|
+
## 风险与失效条件
|
|
41
|
+
|
|
42
|
+
- **把蕴含当等价**:IND-CPA 不能推出 IND-CCA;机密性也不能推出完整性。
|
|
43
|
+
- **无条件评价组合顺序**:MtE/EaM 的结论依赖具体构造,不能只按缩写判安全或不安全。
|
|
44
|
+
- **nonce/密钥复用**:很多 AEAD 在 nonce 重复时同时失去机密性和完整性。
|
|
45
|
+
- **解密错误侧信道**:padding/tag/解析错误差异可形成 oracle。
|
|
46
|
+
- **完美保密类比误用**:$|\mathcal K|\ge|\mathcal M|$ 不能映射成“训练数据量 ≥ 模型参数量”。
|
|
47
|
+
|
|
48
|
+
## 深入参考
|
|
49
|
+
|
|
50
|
+
- `../../references/books/applied-cryptography.md`
|
|
51
|
+
- `../../references/books/introduction-to-modern-cryptography.md`
|
|
52
|
+
|
|
53
|
+
## 路由扩展
|
|
54
|
+
|
|
55
|
+
- 攻击游戏:`attack-game-framework.md`
|
|
56
|
+
- 归约:`reduction-proof-template.md`
|
|
57
|
+
- PRF:`prf-prg-owf.md`
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
# Cryptography Activation Index
|
|
2
|
+
|
|
3
|
+
## Domain Signals
|
|
4
|
+
Activate this domain when the problem involves:
|
|
5
|
+
- Security definitions: formal threat models like CPA/CCA1/CCA2/AE/EUF-CMA
|
|
6
|
+
- Primitives: OWF/PRG/PRF/PRP/CRHF/TDF and their equivalence / construction chains
|
|
7
|
+
- Assumptions: DL/CDH/DDH/RSA/LWE/quantum threats (Shor/Grover)
|
|
8
|
+
- Reduction proofs: black-box reductions, hybrid argument, simulation paradigm, tightness analysis
|
|
9
|
+
- Protocols: encryption/MAC/signature/ZK/AKE/MPC
|
|
10
|
+
- Attack games: formal challenger-vs-adversary interaction framework
|
|
11
|
+
- Post-quantum: lattice-based, code-based, hash-based signatures
|
|
12
|
+
- Advanced constructions: homomorphic encryption, attribute-based encryption, functional encryption, verifiable computation
|
|
13
|
+
|
|
14
|
+
## Core Anchors
|
|
15
|
+
- `prf-prg-owf.en.md` — Pseudorandom function families, pseudorandom generators, and one-way functions (minimal-assumption → basic-primitive equivalence chain)
|
|
16
|
+
- `reduction-proof-template.en.md` — Reduction proof template (constructive "break-scheme ⇒ solve-assumption" reasoning paradigm)
|
|
17
|
+
- `attack-game-framework.en.md` — Attack game framework (challenger-vs-adversary security definition paradigm)
|
|
18
|
+
- `cca-cpa-ae-hierarchy.en.md` — Security hierarchy CPA/CCA/AE (increasing adversary capability layers)
|
|
19
|
+
|
|
20
|
+
## Extension Concepts
|
|
21
|
+
When core anchors are insufficient, these concepts may require temporary activation:
|
|
22
|
+
- Zero-knowledge proofs: interactive/non-interactive (Fiat-Shamir), Sigma protocols, zk-SNARK/zk-STARK
|
|
23
|
+
- Commitment schemes: hiding + binding, hash commitments, Pedersen commitments
|
|
24
|
+
- Secret sharing: Shamir threshold and verifiable secret sharing
|
|
25
|
+
- Homomorphic encryption: partial/leveled/fully homomorphic schemes; BFV/BGV/CKKS/TFHE and bootstrapping
|
|
26
|
+
- Multi-party computation (MPC): Yao garbled circuits, GMW, BGW, SPDZ
|
|
27
|
+
- Verifiable computation (VC): PCP, zk-SNARK, GKR, interactive proofs
|
|
28
|
+
- Differential privacy × cryptography intersection: indistinguishability on adjacent datasets, relation to computational indistinguishability
|
|
29
|
+
- Post-quantum cryptography (PQC): lattice-based (LWE/RLWE), code-based (McEliece), hash-based (SPHINCS+), multivariate
|
|
30
|
+
- Identity-based cryptography (IBE): master key derivation, Boneh-Franklin
|
|
31
|
+
- Attribute-based encryption (ABE): key-policy vs ciphertext-policy, access structures
|
|
32
|
+
- Functional encryption (FE): function keys for decryption
|
|
33
|
+
- Impossibility & separation results: black-box separation, Oracle separation, meta-theorems
|
|
34
|
+
|
|
35
|
+
## Reference Book Directions
|
|
36
|
+
- `../../references/books/applied-cryptography.md`: Boneh & Shoup, attack games + reduction proofs + constructions and protocols
|
|
37
|
+
- `../../references/books/foundations-of-cryptography.md`: Goldreich, definitional methodology + constructive reductions + meta-theorems
|
|
38
|
+
- `../../references/books/introduction-to-modern-cryptography.md`: Katz & Lindell, formal security definitions + construction paradigms + implementation pitfalls
|
|
39
|
+
|
|
40
|
+
## AI×Crypto Boundary
|
|
41
|
+
Load cross-domain material only when a task combines an AI object with a formal cryptographic property:
|
|
42
|
+
- A PRF supplies keyed reproducible pseudorandomness; protection of routing or watermarking depends on the leakage and query game.
|
|
43
|
+
- Commitments, signatures, or MACs can authenticate model artifacts; they do not prove semantic correctness of the model.
|
|
44
|
+
- Zero knowledge/verifiable computation proves an encoded circuit relation; separately prove that the circuit faithfully represents the intended inference.
|
|
45
|
+
- Differential privacy is a statistical privacy definition, not a hardness assumption. When combined with cryptographic protocols, track $(\varepsilon,\delta)$ separately from computational security parameters.
|
|
46
|
+
- Attack-game discipline can specify an ML adversary and winning event, but CPA/CCA cannot simply be renamed as black-box/white-box access.
|
|
47
|
+
- Ordinary hashing, robustness bounds, or simulator analogies do not create cryptographic security.
|
|
48
|
+
|
|
49
|
+
## Temporary Activation Rules
|
|
50
|
+
When the required mathematics is not in core anchors:
|
|
51
|
+
1. First check the extension concepts list for a match
|
|
52
|
+
2. If matched, generate a temporary knowledge card using relevant lenses (game/axiomatization/algorithmic/probabilistic/duality/causal/categorical)
|
|
53
|
+
3. If unmatched, enter Knowledge Gap Protocol
|
|
54
|
+
4. Tag the temporary card's domain as "crypto" or "shared" for subsequent upgrade
|