math-skill 3.2.0 → 3.3.1

package/knowledge-base/cryptography/index.md

@@ -0,0 +1,54 @@
+# 密码学 激活索引 / Cryptography Activation Index
+
+## 领域信号
+当问题涉及以下信号时，激活本领域方向：
+- 安全定义：CPA/CCA1/CCA2/AE/EUF-CMA 等威胁模型的形式化
+- 原语：OWF/PRG/PRF/PRP/CRHF/TDF 及其等价与构造链
+- 假设：DL/CDH/DDH/RSA/LWE/量子威胁（Shor/Grover）
+- 归约证明：黑盒归约、hybrid argument、模拟范式、紧度分析
+- 协议：加密/MAC/签名/零知识/AKE/多方安全计算
+- 攻击游戏：challenger vs adversary 的形式化交互框架
+- 后量子：格密码、编码密码、哈希签名
+- 高级构造：同态加密、属性基加密、函数加密、可验证计算
+
+## 核心锚点
+- `prf-prg-owf.md` — 伪随机函数族、伪随机生成器与单向函数（最小假设→基本原语等价链）
+- `reduction-proof-template.md` — 归约证明模板（"破方案⇒解假设"的构造性推理范式）
+- `attack-game-framework.md` — 攻击游戏框架（challenger vs adversary 的安全定义范式）
+- `cca-cpa-ae-hierarchy.md` — 安全层级 CPA/CCA/AE（威胁模型能力递增层级）
+
+## 扩展概念
+当核心锚点不够时，以下概念可能需要临时激活：
+- 零知识证明：交互式/非交互式（Fiat-Shamir）、Sigma 协议、zk-SNARK/zk-STARK
+- 承诺方案：隐藏性 + 绑定性、哈希承诺、Pedersen 承诺
+- 秘密共享：Shamir 门限、可验证秘密共享
+- 同态加密：部分/层级/全同态；BFV/BGV/CKKS/TFHE 与自举（bootstrapping）
+- 多方安全计算（MPC）：Yao 混淆电路、GMW、BGW、SPDZ
+- 可验证计算（VC）：PCP、zk-SNARK、GKR、interactive proofs
+- 差分隐私与密码学交集：对相邻数据集的不可区分性、与计算不可区分的关系
+- 后量子密码学（PQC）：格基密码（LWE/RLWE）、编码基（McEliece）、哈希基（SPHINCS+）、多变量密码
+- 基于身份的密码学（IBE）：主密钥派生、Boneh-Franklin
+- 属性基加密（ABE）：密钥策略 vs 密文策略、访问结构
+- 函数加密（FE）：带函数密钥的加密
+- 不可能性与分离结果：黑盒分离、Oracle 分离、meta-theorem
+
+## 参考书方向
+- `../../references/books/applied-cryptography.md`：Boneh & Shoup，攻击游戏 + 归约证明 + 构造与协议
+- `../../references/books/foundations-of-cryptography.md`：Goldreich，定义方法论 + 归约可构造性 + 元定理
+- `../../references/books/introduction-to-modern-cryptography.md`：Katz & Lindell，形式化安全定义 + 构造范式 + 实现陷阱
+
+## AI×密码交叉边界
+仅在问题同时包含 AI 对象与形式化密码性质时加载交叉内容：
+- PRF 可提供带密钥、可复现的伪随机性；能否保护路由/水印取决于密钥泄露与查询游戏。
+- 承诺、签名或 MAC 可认证模型工件；它们不会自动证明模型语义正确。
+- 零知识/可验证计算可证明某个已编码电路关系；还需单独证明该电路忠实表示目标推理。
+- 差分隐私是统计隐私定义，不是“困难假设”；与密码协议组合时分别跟踪 $(\varepsilon,\delta)$ 与计算安全参数。
+- 攻击游戏的方法可用于写清 ML 敌手和胜利事件，但 CPA/CCA 名称不能直接改名为黑盒/白盒攻击。
+- 普通哈希、鲁棒性界或模拟器类比不足以产生密码学安全结论。
+
+## 临时激活规则
+当问题需要的数学不在核心锚点中时：
+1. 先检查扩展概念中是否有匹配
+2. 若有，根据透镜（game/axiomatization/algorithmic/probabilistic/duality/causal/categorical）生成临时知识卡
+3. 若无，进入 Knowledge Gap Protocol
+4. 临时卡标注 domain 为 "crypto" 或 "shared"，便于后续升级

package/knowledge-base/cryptography/prf-prg-owf.en.md

@@ -0,0 +1,62 @@
+# One-Way Functions, Pseudorandom Generators, and Pseudorandom Functions
+
+## Minimal Definition
+
+- **One-way function (OWF):** Efficiently computable, while every probabilistic polynomial-time (PPT) algorithm finds any preimage of the image of a random input with only negligible probability.
+- **Pseudorandom generator (PRG):** A deterministic polynomial-time map $G:\{0,1\}^n\to\{0,1\}^{\ell(n)}$, $\ell(n)>n$, such that $G(U_n)$ and $U_{\ell(n)}$ are computationally indistinguishable to every PPT distinguisher.
+- **Pseudorandom function family (PRF):** An efficient keyed family $F_k:\mathcal X\to\mathcal Y$ whose oracle is computationally indistinguishable from a uniformly sampled random function $\mathcal X\to\mathcal Y$ for every PPT oracle distinguisher.
+
+These are asymptotic definitions for families indexed by a growing security parameter, not unconditional claims about one fixed-parameter implementation.
+
+## Core Formulas
+
+- OWF: for every PPT $A$,
+  $$\Pr_{x\leftarrow U_n}\left[f(A(1^n,f(x)))=f(x)\right]\le \operatorname{negl}(n).$$
+- PRG advantage:
+  $$\operatorname{Adv}^{\rm prg}_{G}(D)=\left|\Pr[D(G(U_n))=1]-\Pr[D(U_{\ell(n)}))=1]\right|.$$
+- PRF advantage:
+  $$\operatorname{Adv}^{\rm prf}_{F}(A)=\left|\Pr_{k}[A^{F_k}=1]-\Pr_{R}[A^{R}=1]\right|.$$
+- Existence relations: OWFs exist iff PRGs exist; GGM constructs a PRF from a PRG. A PRF yields a PRP through Feistel: the classical Luby--Rackoff results give a PRP against forward queries with three rounds and a strong PRP against forward and inverse queries with four rounds, with concrete bounds depending on query count and block length.
+- PRP/random-function switching bounds have birthday order $O(q^2/2^n)$. Exact constants depend on the game and inverse-query access, so there is no context-free unique formula.
+
+## Applicable Problems
+
+- Decide whether a keyed construction satisfies the PRF definition and write its real/random oracle game.
+- Analyze GGM-like constructions or PRF-based encryption/MAC constructions through hybrids.
+- Separate standard-model existence theorems, primitive-based reductions, and concrete assumptions that treat AES/HMAC as PRFs.
+- Account for birthday loss, key/domain separation, and multi-user security.
+
+## Cryptographic Construction and Cross-Domain Boundary
+
+- Practical systems normally use analyzed candidates or standardized constructions such as HMAC, CMAC/KMAC, or block-cipher-based modes, rather than directly implementing generic HILL/GGM existence constructions.
+- In AI×crypto tasks, a PRF can provide keyed reproducible pseudorandomness, but only relative to a stated oracle and leakage model. Parameters, gradients, logs, or distributed training may reveal key-related information outside the original game.
+- An OWF does not automatically make hashed features private; input distributions, auxiliary information, collisions, and membership inference need separate models.
+- Yao's next-bit characterization concerns binary distribution ensembles and efficient predictors. Without defining encoding, conditional distributions, and a security parameter, it does not imply “hard next-token prediction makes an entire language-model output pseudorandom.”
+
+## Implementation Considerations
+
+- PRFs are normally implemented with bit operations, permutations, hash/compression functions, or dedicated cryptographic instructions, not “small GEMMs.” AES-NI and SHA-NI are CPU ISA features and are not evidence of GPU feasibility.
+- Nonces, counters, domain tags, and derived subkeys must satisfy the protocol's uniqueness and separation requirements. Reusing one PRF without domain separation can invalidate independence assumptions.
+- If GPU throughput is explicitly requested, analyze the concrete implementation's batching, memory access, and side channels. Performance analysis does not replace a security proof.
+- State the quantum query model. Grover gives a square-root improvement in ideal black-box query complexity, but concrete strength also depends on circuit depth, parallel resources, and the attack model; “halve the key bits” is not a complete assessment.
+
+## Risks and Failure Conditions
+
+- **Treating a concrete primitive as a theorem:** AES/HMAC PRF behavior is an adopted concrete-security assumption supported by analysis, not an unconditional theorem derived from the specification.
+- **Ignoring query and multi-user loss:** Query count, user count, and message length may amplify advantage through birthdays or hybrid steps.
+- **Confusing unpredictability and indistinguishability:** Their equivalence needs precise definitions and reductions; empirical prediction accuracy is not a cryptographic advantage.
+- **Treating generic constructions as engineering recipes:** HILL/GGM establish existence and reductions, not acceptable constants, parallelism, or throughput.
+- **Cross-domain model mismatch:** Side information, distribution shift, and adaptive ML queries may exceed the original security game.
+
+## Further References
+
+- `../../references/books/foundations-of-cryptography.md`: OWF/PRG theory and GGM.
+- `../../references/books/applied-cryptography.md`: PRF/PRP games and switching arguments.
+- `../../references/books/introduction-to-modern-cryptography.md`: formal definitions and Feistel.
+
+## Routing Extensions
+
+- Reductions: `reduction-proof-template.en.md`
+- Games: `attack-game-framework.en.md`
+- CPA/CCA/AE: `cca-cpa-ae-hierarchy.en.md`
+- Probability bounds: `../probability/concentration-inequality.en.md`

package/knowledge-base/cryptography/prf-prg-owf.md

@@ -0,0 +1,62 @@
+# 单向函数、伪随机生成器与伪随机函数 / OWF, PRG, and PRF
+
+## 最小定义
+
+- **单向函数（OWF）**：易于计算，但对随机输入的像，任何概率多项式时间（PPT）算法都只能以可忽略概率找到任一原像。
+- **伪随机生成器（PRG）**：确定性多项式时间算法 $G:\{0,1\}^n\to\{0,1\}^{\ell(n)}$，其中 $\ell(n)>n$，且 $G(U_n)$ 与 $U_{\ell(n)}$ 对所有 PPT 区分器计算不可区分。
+- **伪随机函数族（PRF）**：高效密钥函数族 $F_k:\mathcal X\to\mathcal Y$，其可查询接口与从所有 $\mathcal X\to\mathcal Y$ 函数中均匀抽取的真随机函数，对所有 PPT oracle 区分器计算不可区分。
+
+这些都是关于**安全参数增长下的族**的渐近定义，不是对某个固定参数实现的无条件结论。
+
+## 核心公式
+
+- OWF：对所有 PPT $A$，
+  $$\Pr_{x\leftarrow U_n}\left[f(A(1^n,f(x)))=f(x)\right]\le \operatorname{negl}(n).$$
+- PRG 优势：
+  $$\operatorname{Adv}^{\rm prg}_{G}(D)=\left|\Pr[D(G(U_n))=1]-\Pr[D(U_{\ell(n)}))=1]\right|.$$
+- PRF 优势：
+  $$\operatorname{Adv}^{\rm prf}_{F}(A)=\left|\Pr_{k}[A^{F_k}=1]-\Pr_{R}[A^{R}=1]\right|.$$
+- 存在性关系：OWF 存在当且仅当 PRG 存在；PRG 可经 GGM 构造 PRF。由 PRF 经 Feistel 可构造 PRP：经典 Luby--Rackoff 结论是 3 轮给出选择明文意义下的 PRP，4 轮给出允许正反向查询的强 PRP（具体界依赖查询数与分组长度）。
+- PRP/随机函数切换界的典型量级为生日界 $O(q^2/2^n)$；精确常数取决于采用的游戏和是否允许逆向查询，不能脱离版本固定写成唯一公式。
+
+## 适用问题
+
+- 判断一个 keyed construction 是否满足 PRF 定义，并写出真实/随机 oracle 游戏。
+- 用 hybrid argument 分析 GGM 类构造或从 PRF 构造加密/MAC。
+- 区分“标准模型中的存在性定理”“基于某原语的归约”和“把 AES/HMAC 当 PRF 的具体安全假设”。
+- 估计查询数带来的生日界损失，检查 key/domain separation 与多用户安全。
+
+## 密码学构造与跨域边界
+
+- 实用系统通常使用经分析的 PRF 候选或标准化构造（例如 HMAC、CMAC/KMAC 或基于分组密码的模式），而不是直接实现 HILL/GGM 的通用存在性构造。
+- 在 AI×密码交叉问题中，PRF 可作为带密钥、可复现的伪随机源，但结论只针对明确的 oracle/泄露模型。模型参数、梯度、日志或分布式训练若泄露密钥相关信息，原安全游戏可能不再适用。
+- OWF 不会自动让“哈希后的特征”保密：输入分布、辅助信息、碰撞和成员推断都需单独建模。
+- Yao 的 next-bit characterization 针对二进制分布族和高效预测器。它不能不经编码、条件分布与安全参数定义，直接推出自然语言模型“下一 token 难预测 ⇒ 整段输出伪随机”。
+
+## 实现注意事项
+
+- PRF 实现通常是位运算、置换、哈希/压缩函数或专用密码指令，不是“小 GEMM”。AES-NI/SHA-NI 是 CPU 指令集特性，不能作为 GPU 可行性的证据。
+- nonce、counter、domain tag 和派生子密钥必须按协议唯一/分离；“同一 PRF 到处复用”会破坏证明所需的独立性。
+- 若用户明确问 GPU 吞吐，再按具体实现分析并行批量、访存与侧信道；这属于性能检查，不替代安全证明。
+- 量子查询模型必须明确。Grover 给出理想黑盒查询复杂度的平方级加速，但具体安全强度还取决于电路深度、并行资源和攻击模型，不能只写“密钥位数减半”作为完整评估。
+
+## 风险与失效条件
+
+- **具体原语当定理**：AES/HMAC 的 PRF 性质是广泛采用的安全假设/分析结论，不是从其规范无条件证明出的定理。
+- **忽略查询与多用户损失**：$q$、用户数和消息长度可能通过生日界或 hybrid 次数放大优势。
+- **混淆不可预测与不可区分**：两者的等价需要精确定义与归约；经验预测准确率不能直接替代密码学优势。
+- **把通用构造当工程方案**：HILL/GGM 说明存在性和可归约性，不代表常数、并行性或吞吐可接受。
+- **跨域假设失配**：ML 部署中的侧信息、分布漂移和自适应查询可能超出原安全游戏。
+
+## 深入参考
+
+- `../../references/books/foundations-of-cryptography.md`：OWF/PRG 与 GGM 的理论链。
+- `../../references/books/applied-cryptography.md`：PRF/PRP 游戏和切换论证。
+- `../../references/books/introduction-to-modern-cryptography.md`：形式化定义与 Feistel 构造。
+
+## 路由扩展
+
+- 归约证明：`reduction-proof-template.md`
+- 攻击游戏：`attack-game-framework.md`
+- CPA/CCA/AE：`cca-cpa-ae-hierarchy.md`
+- 概率界：`../probability/concentration-inequality.md`

package/knowledge-base/cryptography/reduction-proof-template.en.md

@@ -0,0 +1,60 @@
+# Reduction-Proof Template
+
+## Minimal Definition
+
+A security reduction constructs an algorithm $B$ that uses a scheme-breaking adversary $A$ as a subroutine to solve a defined hard problem. The conclusion is conditional: if the assumption remains hard for the resulting resources, and the simulation and parameter bounds hold, then no adversary in the corresponding resource range can break the scheme.
+
+## Core Formulas
+
+A typical concrete-security bound is
+$$
+\operatorname{Adv}^{\mathsf{scheme}}(A)
+\le L(q,n)\operatorname{Adv}^{\mathsf{assump}}(B)+\delta(q,n),
+$$
+where $L$ is reduction loss and $\delta$ collects collisions, simulation failures, and similar events. Report $B$'s running time and oracle queries as well as advantage.
+
+- Difference lemma: if games diverge only after `bad`, their advantage difference is at most $\Pr[\mathsf{bad}]$.
+- Hybrid: $|p_0-p_t|\le\sum_{i=0}^{t-1}|p_i-p_{i+1}|$; every step bound and the number of steps enter the final loss.
+- Asymptotic closure $\operatorname{poly}\cdot\operatorname{negl}=\operatorname{negl}$ does not imply an acceptable fixed-parameter value.
+
+## Applicable Problems
+
+- Prove encryption, MAC, signature, or protocol security from PRF/PRP, OWF, DDH/LWE, or related assumptions.
+- Check whether a reduction's simulation is perfect, statistically close, or computationally indistinguishable.
+- Track loss from guessing, rewinding, hybrids, and forking.
+- Compare standard-model, ROM/QROM, and black-box/non-black-box proof boundaries.
+
+## Cryptographic Construction and Cross-Domain Boundary
+
+- A reduction is not causal inference or an analogy between problems. It requires executable $B$, interface simulation, and a success-probability relation.
+- AI robustness or watermarking warrants a cryptographic-reduction claim only after defining a security game, parameter, adversarial resources, and hard problem. Ordinary Lipschitz certificates, generalization bounds, and differential-privacy guarantees are not “cryptographic hardness assumptions.”
+- Hybrid summation can analyze general distribution changes, but using that inequality alone does not create cryptographic security.
+- A simulator that reproduces some output distribution does not by itself prove training-data privacy; it needs a formal indistinguishability/simulation definition or a formal DP bound.
+
+## Implementation Considerations
+
+- Specify how $B$ generates parameters, answers every query, embeds the challenge, handles aborts, and extracts a solution from $A$.
+- Label every game hop as identical, statistically bounded, assumption-based, or bad-event-based.
+- Substitute advantage, time, queries, users, and failure terms into concrete parameters; “polynomial loss” is not a numerical analysis.
+- GPU performance is orthogonal to reduction validity. Analyze it separately only for a concrete primitive implementation.
+
+## Risks and Failure Conditions
+
+- **Wrong direction:** “Solving the assumption enables an attack” usually does not prove “an attack solves the assumption.”
+- **Unproved simulation:** If $A$ distinguishes the simulated view from the real game, its claimed advantage cannot be reused.
+- **Missing tightness/resources:** Small advantage loss can coexist with impractical time or query overhead.
+- **Model mismatch:** ROM/QROM, selective/adaptive, and single-/multi-user models cannot be switched silently.
+- **Uncounted abort/guessing:** Guessing an index or conditional abort can dominate the loss.
+- **Existence versus parameters:** An asymptotic reduction does not establish that the current key size is sufficient.
+
+## Further References
+
+- `../../references/books/foundations-of-cryptography.md`
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## Routing Extensions
+
+- Games: `attack-game-framework.en.md`
+- PRF/OWF: `prf-prg-owf.en.md`
+- CPA/CCA/AE: `cca-cpa-ae-hierarchy.en.md`

package/knowledge-base/cryptography/reduction-proof-template.md

@@ -0,0 +1,60 @@
+# 归约证明模板 / Reduction-Proof Template
+
+## 最小定义
+
+安全归约构造算法 $B$，把破坏方案的敌手 $A$ 当作子程序，用 $A$ 的成功来解决某个已定义的困难问题。正确结论是条件式：若假设问题对给定资源的算法仍困难，且模拟与参数界成立，则不存在相应资源范围内的成功敌手。
+
+## 核心公式
+
+典型具体安全界写成
+$$
+\operatorname{Adv}^{\mathsf{scheme}}(A)
+\le L(q,n)\operatorname{Adv}^{\mathsf{assump}}(B)+\delta(q,n),
+$$
+其中 $L$ 是归约损失，$\delta$ 汇总碰撞、模拟失败等项。必须同时报告 $B$ 的运行时间和 oracle 查询数，不能只比较优势。
+
+- Difference Lemma：两游戏仅在 `bad` 后分歧时，优势差至多 $\Pr[\mathsf{bad}]$。
+- Hybrid：$|p_0-p_t|\le\sum_{i=0}^{t-1}|p_i-p_{i+1}|$；每步界与步数都要进入最终损失。
+- 渐近闭合性 $\operatorname{poly}\cdot\operatorname{negl}=\operatorname{negl}$ 只说明最终仍可忽略，不说明固定参数下数值可接受。
+
+## 适用问题
+
+- 从 PRF/PRP、OWF、DDH/LWE 等假设证明加密、MAC、签名或协议安全。
+- 审查 reduction 的模拟是否完美/统计接近/计算不可区分。
+- 跟踪 guessing、rewinding、hybrid、forking 等步骤的损失。
+- 比较标准模型、ROM/QROM、黑盒/非黑盒证明的假设边界。
+
+## 密码学构造与跨域边界
+
+- 归约不是因果推断，也不是“两个问题相似”的类比；必须给出可执行的 $B$、接口模拟和成功概率关系。
+- AI 鲁棒性或水印只有在安全游戏、安全参数、敌手资源和底层困难问题都被正式定义时，才可声称密码学归约。普通 Lipschitz 证书、统计泛化界或差分隐私保证不是“密码学困难假设”。
+- Hybrid 的求和技巧可用于一般分布变化分析，但那只是数学不等式；不要因此宣称获得密码学安全。
+- 模拟器能生成某种输出分布，并不自动证明训练数据隐私；需要明确的 indistinguishability/simulation 定义或正式的 DP 参数。
+
+## 实现注意事项
+
+- 写出 $B$ 如何生成公共参数、回答每类查询、嵌入挑战、处理 abort，并从 $A$ 的输出提取解。
+- 为每个游戏跳转注明依据：完全相同、统计距离、计算假设或 bad-event bound。
+- 具体参数选择应把优势、时间、查询、多用户和失败项一起代入；不能用“多项式损失”替代数值分析。
+- GPU 性能与归约有效性正交；仅当用户问具体原语实现时另做性能分析。
+
+## 风险与失效条件
+
+- **方向写反**：从“能解假设 ⇒ 能攻击方案”通常不能推出“攻击方案 ⇒ 能解假设”。
+- **模拟不可分辨未证明**：$A$ 在模拟环境中的视图若与真实游戏可区分，调用其优势无效。
+- **紧度与资源漏项**：优势损失小但 $B$ 运行时间或查询数过大，仍可能没有有意义的具体安全。
+- **模型错配**：ROM/QROM、选择性/自适应安全、单用户/多用户之间不能静默切换。
+- **abort/guessing 未计入**：猜 challenge index 或条件中止会产生显著损失。
+- **把存在性当实用参数**：渐近归约成立不保证当前 key size 足够。
+
+## 深入参考
+
+- `../../references/books/foundations-of-cryptography.md`
+- `../../references/books/applied-cryptography.md`
+- `../../references/books/introduction-to-modern-cryptography.md`
+
+## 路由扩展
+
+- 攻击游戏：`attack-game-framework.md`
+- PRF/OWF：`prf-prg-owf.md`
+- CPA/CCA/AE：`cca-cpa-ae-hierarchy.md`

package/knowledge-base/matrix-analysis/low-rank-approximation.en.md

@@ -18,7 +18,7 @@ Given a matrix $A \in \mathbb{R}^{m \times n}$, find a matrix $B$ with rank at m
 - LoRA weight compression: $W \approx W_0 + BA$, $B \in \mathbb{R}^{d \times r}, A \in \mathbb{R}^{r \times d}$, $r \ll d$
 - KV-Cache compression: projecting Key/Value caches into a low-rank factor format, reducing memory from $O(Ld)$ to $O(Lk + kd)$; standard softmax still has sequence length $L$
 - PCA / whitening: the top $k$ principal components of the data covariance matrix correspond to the truncated SVD
-- Gradient compression: the effective rank of gradient matrices in large models is often much lower than the nominal rank, allowing safe truncation
+- Gradient compression: if measured singular values decay rapidly, truncate with error feedback to control bias. “Gradients are inherently low-rank and safe to truncate” is not a general theorem.
 - Recommender systems / matrix completion: low-rank factorization $R \approx UV^H$
 
 ## AI Design Translation
@@ -40,7 +40,7 @@ Given a matrix $A \in \mathbb{R}^{m \times n}$, find a matrix $B$ with rank at m
 
 - **Incorrect rank selection**: $k$ too small causes information loss ($\sigma_{k+1}$ is non-negligible); $k$ too large negates the compression benefit. Solution: monitor the singular value decay curve and select the elbow point where $\sum_{i>k}\sigma_i^2 / \sum\sigma_i^2 < \epsilon$.
 - **Insufficient randomized SVD accuracy**: When oversampling $p$ is too small (typically $p = 5 \sim 10$) or the number of power iteration steps is insufficient, low-order singular value estimates can be significantly biased. Solution: add $q = 1 \sim 2$ power iteration steps $Y = (AA^H)^q A\Omega$, at the cost of additional matmul operations.
-- **LoRA not applicable to all layers**: Q/K/V in attention is typically effectively low-rank, but the effective rank of FFN layers and embeddings may be close to full rank, and applying LoRA forcefully degrades accuracy. Layer-by-layer effective rank diagnosis is required.
+- **LoRA is not uniformly effective across layers**: Update spectra vary by layer and task; do not assume Q/K/V are low-rank while FFN/embeddings are full-rank. Compare per-layer spectra, validation loss, and equal-parameter baselines.
 - **SVD overhead of nuclear norm proximal**: Soft-thresholding $\text{prox}_{\lambda\|\cdot\|_*}(A) = U(\Sigma - \lambda I)_+ V^H$ requires SVD, which is prohibitively expensive for large matrices at every step. Solution: use factorization alternatives or randomized approximations.
 
 ## Further References

package/knowledge-base/matrix-analysis/low-rank-approximation.md

@@ -18,7 +18,7 @@
 - LoRA 权重压缩：$W \approx W_0 + BA$，$B \in \mathbb{R}^{d \times r}, A \in \mathbb{R}^{r \times d}$，$r \ll d$
 - KV-Cache 压缩：将 Key/Value 缓存投影到低秩因子格式，显存从 $O(Ld)$ 变为 $O(Lk + kd)$；标准 softmax 下序列长度仍为 $L$
 - PCA / 白化：数据协方差的前 $k$ 个主成分即截断 SVD
-- 梯度压缩：大模型梯度矩阵的有效秩通常远低于名义秩，可安全截断
+- 梯度压缩：若实测奇异值衰减快，可截断并用误差反馈控制偏差；“梯度天然低秩、可安全截断”不是普遍定理
 - 推荐系统 / 矩阵补全：低秩因子分解 $R \approx UV^H$
 
 ## AI 设计翻译
@@ -40,7 +40,7 @@
 
 - **秩选择错误**：$k$ 过小导致信息丢失（$\sigma_{k+1}$ 不可忽略），$k$ 过大失去压缩意义。解决：监控奇异值衰减曲线，选 $\sum_{i>k}\sigma_i^2 / \sum\sigma_i^2 < \epsilon$ 的拐点。
 - **随机化 SVD 精度不足**：oversampling $p$ 太小（通常 $p = 5 \sim 10$）或 power iteration 次数不足时，低阶奇异值估计偏差大。解决：增加 $q = 1 \sim 2$ 步 power iteration $Y = (AA^H)^q A\Omega$，但增加 matmul 次数。
-- **LoRA 不适用于所有层**：Attention 的 Q/K/V 通常低秩有效，但 FFN 层和 embedding 的有效秩可能接近满秩，强行 LoRA 会损失精度。需逐层诊断有效秩。
+- **LoRA 不适用于所有层**：不同层和任务的更新谱差异很大，不能预设 Q/K/V 一定低秩而 FFN/embedding 一定满秩。应比较逐层奇异值、验证损失与相同参数预算下的基线。
 - **核范数 proximal 的 SVD 开销**：soft-thresholding $\text{prox}_{\lambda\|\cdot\|_*}(A) = U(\Sigma - \lambda I)_+ V^H$ 需要 SVD，大矩阵每步算不起。解决：用因子化替代或随机化近似。
 
 ## 深入参考

package/knowledge-base/matrix-analysis/projection.en.md

@@ -6,9 +6,9 @@ Maps a vector $v$ onto a subspace $\mathcal{S}$ such that the residual $v - Pv$
 
 ## Core Formulas
 
-- Projection matrix: $P = A(A^HA)^{-1}A^H$, where the columns of $A$ span the subspace $\mathcal{S}$
+- If $A$ has full column rank and column space $\mathcal{S}$, then $P=A(A^HA)^{-1}A^H$; in general use the Moore--Penrose pseudoinverse, $P=AA^\dagger$
 - If the columns of $A$ are orthonormal ($A^HA = I$), then $P = AA^H$
-- Nearest distance after projection: $\|v - Pv\|^2 = \|v\|^2 - \|A^Hv\|^2$
+- If $Q$ is an orthonormal basis, then $\|v-QQ^Hv\|^2=\|v\|^2-\|Q^Hv\|^2$
 - Courant-Fischer variational characterization: $\lambda_k = \max_{\dim(S)=k} \min_{x \in S, \|x\|=1} x^HAx$
 - Orthogonal complement projection: $P^\perp = I - P$
 
@@ -16,30 +16,29 @@ Maps a vector $v$ onto a subspace $\mathcal{S}$ such that the residual $v - Pv$
 
 - Least squares regression: $\hat{x} = \arg\min \|Ax - b\|^2$ is equivalent to projecting $b$ onto $\text{Col}(A)$
 - PCA dimensionality reduction: projecting data onto the subspace spanned by the top $k$ principal components
-- Feasible directions in constrained optimization: projecting the gradient onto the constraint tangent space (projected gradient method)
+- Feasible directions for smooth equality constraints/manifolds: project the gradient onto the tangent space. General projected-gradient methods for convex constraints instead project the updated point back onto the feasible set.
 - Orthogonal decomposition in residual networks: decomposing a signal into an explained component + residual
 
 ## AI Design Translation
 
-- **Low-rank bottleneck analysis for linear layers**: The truncation $W = U_k \Sigma_k V_k^H$ is a projection onto a rank-$k$ subspace; implemented via `torch.mm(U_k, torch.mm(Sigma_k, V_k.t()))` as three matmul steps, reducing memory from $O(mn)$ to $O(k(m+n))$
-- **Subspace projection in attention heads**: The Q/K/V matrices essentially project inputs into different subspaces for similarity computation; multi-head = parallel projection subspaces, directly implementable as batched matmul
-- **Projection head (contrastive learning)**: The projection head in SimCLR/MoCo = a multi-layer MLP followed by $L_2$-normalize, equivalent to projecting onto the unit sphere; implemented as `F.normalize(self.mlp(x), dim=-1)`, an elementwise norm operation
+- **Low-rank bottleneck analysis for linear layers**: Truncated SVD $W_k=U_k\Sigma_kV_k^H$ is a best rank-$k$ approximation under the standard unitarily invariant norms and can be stored as factors using $O(k(m+n))$ parameters. This does not make $W_k$ a projection operator.
+- **Subspace maps in attention heads**: Q/K/V are generally learned linear maps, not orthogonal projections unless idempotence and Hermitian symmetry hold. Batched GEMM still implements multiple heads, but orthogonal head subspaces require an explicit constraint and verification.
+- **Projection heads in contrastive learning**: A SimCLR/MoCo projection head is an MLP. Final $L_2$ normalization maps nonzero vectors radially to the unit sphere; it is neither a linear projection nor Euclidean projection onto a convex set.
 - **Gradient projection / Orthogonal Gradient Descent (OGD)**: In continual learning, projecting the new-task gradient onto the orthogonal complement of the old-task gradient space to avoid catastrophic forgetting; requires maintaining a basis matrix $G$ and computing $(I - G(G^TG)^{-1}G^T)\nabla$, with the core being two matmul operations
-- **Orthogonal residuals in ResNet**: The residual connection $x + F(x)$ can be interpreted as a projection onto the identity subspace + orthogonal correction; spectral normalization constrains the Lipschitz constant of $F$ to stabilize the projection
 
 ## Engineering Feasibility
 
-- **Primary operations**: Matrix multiplication (matmul) + matrix inversion/Cholesky. When the subspace dimension $k$ is much smaller than $n$, $(A^HA)^{-1}$ only requires inverting a $k \times k$ matrix, at negligible cost.
-- **GPU friendliness**: High. $P = AA^H$ (orthonormal columns case) is two matmul operations, perfectly mapped to tensor cores. The Cholesky decomposition for the non-orthogonal case has cuSOLVER batched implementations.
-- **Complexity**: Projection operation $O(nk)$ per vector (orthonormal basis case), basis construction $O(nk^2)$ (Gram-Schmidt) or $O(n^2k)$ (QR decomposition).
-- **Low precision**: Under bf16, $A^HA$ may lose positive definiteness; a jitter $\epsilon I$ ($\epsilon \sim 10^{-6}$) must be added.
+- **Primary operations**: Given an orthonormal basis $Q\in\mathbb{R}^{n\times k}$, apply the projection as $Q(Q^Hx)$ rather than materializing an $n\times n$ matrix. To obtain a basis from non-orthogonal $A$, prefer QR/SVD over explicitly forming $(A^HA)^{-1}$.
+- **GPU friendliness**: Projection application is two GEMV/GEMM operations. Large batches can use Tensor Cores; small $k$ or single-vector workloads may be launch- or memory-bound, so matmul expressibility alone does not imply high utilization.
+- **Complexity**: Applying the projection costs $O(nk)$ per vector. Thin QR of an $n\times k$ matrix with $n\ge k$ is typically $O(nk^2)$.
+- **Low precision**: Normal equations square the condition number. Jitter must be scaled to the data, dtype, and error tolerance; $10^{-6}$ is not universal. Prefer fp32 accumulation and QR/SVD.
 
 ## Risks and Failure Conditions
 
 - **Ill-conditioned basis matrix**: When the condition number $\kappa(A) \gg 1$, $(A^HA)^{-1}$ suffers catastrophic cancellation under low precision. Solution: first perform QR decomposition to obtain an orthonormal basis $Q$, then use $P = QQ^H$, avoiding explicit inversion.
 - **Excessively high subspace dimension**: When $k$ approaches $n$, the projection degenerates to the identity mapping, wasting computation. A randomized SVD should first be performed to confirm the effective rank.
 - **Non-stationary subspace**: In online/continual learning, the projection basis drifts with the data; the basis matrix must be periodically updated (incremental QR), otherwise the projection directions become stale.
-- **Non-orthogonal projection**: Oblique projections where $P^2 = P$ but $P \neq P^H$ are numerically unstable in floating point and should be avoided; if they must be used, monitor $\|P - P^H\|_F$.
+- **Oblique projection**: If $P^2=P$ but $P\ne P^H$, the map no longer gives Euclidean nearest points. Stability depends on the angle/conditioning between its range and null space; $\|P-P^H\|_F$ alone is not a sufficient diagnostic. Monitor the operator norm or basis conditioning.
 
 ## Further References
 

package/knowledge-base/matrix-analysis/projection.md

@@ -6,9 +6,9 @@
 
 ## 核心公式
 
-- 投影矩阵：$P = A(A^HA)^{-1}A^H$，其中 $A$ 的列张成子空间 $\mathcal{S}$
+- 若 $A$ 满列秩且列空间为 $\mathcal{S}$，投影矩阵为 $P = A(A^HA)^{-1}A^H$；一般情形用 Moore--Penrose 伪逆写成 $P=AA^\dagger$
 - 若 $A$ 列正交归一（$A^HA = I$），则 $P = AA^H$
-- 投影后最近距离：$\|v - Pv\|^2 = \|v\|^2 - \|A^Hv\|^2$
+- 若 $Q$ 是子空间的正交基，则：$\|v-Q Q^Hv\|^2=\|v\|^2-\|Q^Hv\|^2$
 - Courant-Fischer 变分刻画：$\lambda_k = \max_{\dim(S)=k} \min_{x \in S, \|x\|=1} x^HAx$
 - 正交补投影：$P^\perp = I - P$
 
@@ -16,30 +16,29 @@
 
 - 最小二乘回归：$\hat{x} = \arg\min \|Ax - b\|^2$ 即求 $b$ 在 $\text{Col}(A)$ 上的投影
 - PCA 降维：数据投影到前 $k$ 个主成分张成的子空间
-- 约束优化中的可行方向：将梯度投影到约束切空间（投影梯度法）
+- 光滑等式约束/流形优化中的可行方向：将梯度投影到切空间；一般凸约束的 projected gradient 则把更新点投影回可行集
 - 残差网络的正交分解：将信号分解为已解释部分 + 残差
 
 ## AI 设计翻译
 
-- **Linear 层的低秩瓶颈分析**：$W = U_k \Sigma_k V_k^H$ 的截断即投影到秩-$k$ 子空间；用 `torch.mm(U_k, torch.mm(Sigma_k, V_k.t()))` 三步 matmul 实现，显存从 $O(mn)$ 降到 $O(k(m+n))$
-- **Attention 头的子空间投影**：Q/K/V 矩阵本质是把输入投影到不同子空间做相似度计算；多头 = 多个投影子空间的并行，可直接 batched matmul
-- **Projection Head (对比学习)**：SimCLR/MoCo 的 projection head = 多层 MLP 后接 $L_2$-normalize，等价于投影到单位球面；实现为 `F.normalize(self.mlp(x), dim=-1)`，是 elementwise norm 操作
+- **Linear 层的低秩瓶颈分析**：截断 SVD $W_k=U_k\Sigma_kV_k^H$ 是矩阵范数下的最佳秩-$k$ 逼近，可存为两个因子以把参数量从 $O(mn)$ 降到 $O(k(m+n))$；这不等于说 $W_k$ 本身是投影算子
+- **Attention 头的子空间映射**：Q/K/V 通常只是学习到的线性映射；只有满足幂等与 Hermitian 条件时才是正交投影。多头实现仍可用 batched GEMM，但“不同头对应正交子空间”需要额外约束与验证
+- **Projection Head（对比学习）**：SimCLR/MoCo 的 projection head 是 MLP；末端 $L_2$ normalization 把非零向量径向归一到单位球面，但它不是线性投影，也不是投到凸集的欧氏最近点映射
 - **梯度投影 / 正交梯度下降 (OGD)**：在持续学习中，将新任务梯度投影到旧任务梯度空间的正交补，避免灾难性遗忘；需维护基矩阵 $G$ 并计算 $(I - G(G^TG)^{-1}G^T)\nabla$，核心是两次 matmul
-- **ResNet 的正交残差**：残差连接 $x + F(x)$ 可理解为在恒等子空间上的投影 + 正交修正；谱归一化约束 $F$ 的 Lipschitz 使投影稳定
 
 ## 工程可行性
 
-- **主要操作**：矩阵乘法 (matmul) + 矩阵求逆/Cholesky。当子空间维度 $k$ 远小于 $n$ 时，$(A^HA)^{-1}$ 只需对 $k \times k$ 矩阵求逆，代价可忽略。
-- **GPU 友好度**：高。$P = AA^H$（列正交情形）是两次 matmul，完美映射 tensor core。非正交情形的 Cholesky 分解有 cuSOLVER batched 实现。
-- **复杂度**：投影操作 $O(nk)$ per vector（正交基情形），构造基 $O(nk^2)$（Gram-Schmidt）或 $O(n^2k)$（QR 分解）。
-- **低精度**：bf16 下 $A^HA$ 可能丢正定性，需加 jitter $\epsilon I$（$\epsilon \sim 10^{-6}$）。
+- **主要操作**：对已有正交基 $Q\in\mathbb{R}^{n\times k}$ 应直接计算 $Q(Q^Hx)$，避免显式物化 $n\times n$ 的 $P$。若从非正交 $A$ 构造基，优先用 QR/SVD 而非显式形成 $(A^HA)^{-1}$。
+- **GPU 友好度**：应用投影主要是两次 GEMV/GEMM；批量足够大时可利用 Tensor Core。小 $k$ 或单向量场景可能受内存/launch 开销限制，不能仅凭“可写成 matmul”断言高利用率。
+- **复杂度**：应用投影为每向量 $O(nk)$；对 $n\times k$（$n\ge k$）矩阵做 thin QR 通常为 $O(nk^2)$。
+- **低精度**：形成正规方程会把条件数平方。jitter 的大小依赖数据尺度、dtype 与容许偏差，不存在通用的 $10^{-6}$；稳定方案是以 fp32 累加并用 QR/SVD。
 
 ## 风险与失效条件
 
 - **基矩阵病态**：当 $A$ 条件数 $\kappa(A) \gg 1$ 时，$(A^HA)^{-1}$ 在低精度下灾难性抵消。解决：先 QR 分解得正交基 $Q$，再用 $P = QQ^H$，避免显式求逆。
 - **子空间维度过高**：$k$ 接近 $n$ 时投影退化为恒等映射，计算浪费。需先做随机 SVD 确认有效秩。
 - **非平稳子空间**：在线学习/持续学习中投影基随数据漂移，需定期更新基矩阵（增量 QR），否则投影方向过期。
-- **非正交投影**：$P^2 = P$ 但 $P \neq P^H$ 的斜投影在浮点下不稳定，应避免；若必须用，需监控 $\|P - P^H\|_F$。
+- **斜投影**：$P^2=P$ 但 $P\ne P^H$ 时不再给出欧氏最近点；其稳定性取决于像空间与核空间的夹角/条件数，不能仅用 $\|P-P^H\|_F$ 判定。需要显式监控算子范数或相关基的条件数。
 
 ## 深入参考
 

package/knowledge-base/overview.en.md

@@ -4,7 +4,7 @@
 
 ## Knowledge Base Structure
 
-The knowledge base is organized by mathematical domain, with 7 domains and 31 knowledge cards. Each card contains: minimal definition, core formulas, applicable problems, AI design translation, engineering feasibility, risks and failure conditions.
+The knowledge base has 9 domain directories and 37 cards: 33 shared-math anchors across 8 domains, plus 4 domain-specific cryptography anchors. Shared-math cards may include AI/engineering translations when relevant; cryptography cards preserve security-definition, construction, and reduction semantics without forcing AI or GPU sections.
 
 | Domain | Directory | Cards | Typical Applications |
 |--------|-----------|-------|---------------------|
@@ -15,6 +15,8 @@ The knowledge base is organized by mathematical domain, with 7 domains and 31 kn
 | Topology | `topology/` | persistent-homology, euler-characteristic, fundamental-group | Topological regularization, latent space monitoring |
 | Probability & Information | `probability/` | concentration-inequality, entropy, kl-divergence, information-bottleneck, fisher-information | VAE, knowledge distillation, generalization bounds |
 | Information Geometry | `information-geometry/` | natural-gradient, fisher-metric | Natural gradient descent, Fisher-Rao metric |
+| Algebraic Geometry | `algebraic-geometry/` | grassmannian-plucker, sheaf-cohomology | Subspace parameterization, local-to-global consistency |
+| Cryptography (domain-specific) | `cryptography/` | prf-prg-owf, attack-game-framework, cca-cpa-ae-hierarchy, reduction-proof-template | Security definitions, constructions, games, and reductions |
 
 ## From Problem to Knowledge Card
 
@@ -30,13 +32,13 @@ The knowledge base is organized by mathematical domain, with 7 domains and 31 kn
 
 ## When Anchors Are Not Enough
 
-The current 31 anchors cover the most commonly used mathematical structures in AI research. When a problem requires mathematical tools not among them:
+The current 33 shared-math anchors and 4 cryptography anchors cover high-frequency structures. When a problem requires a tool not among them:
 
 1. Check the corresponding domain's `*/index.en.md` (e.g., `topology/index.en.md`) for extended concepts and reference book directions
-2. Enter the **Knowledge Gap Protocol** defined in `../skills/math-research-activator/SKILL.en.md` to generate a temporary knowledge card
+2. Enter the **Knowledge Gap Protocol** in root `../SKILL.en.md` to generate a temporary knowledge card
 3. Never respond with "knowledge base does not cover this" or force-fit the closest card
 
-> **Domain Router note** (v3.2.0): This knowledge base primarily serves the **AI Research Layer** and **Shared Math Layer**. If Domain Router determines the problem belongs to the **Cryptography Layer**, first consult the three crypto books listed in `../references/skill-index.en.md`; shared math anchors (e.g., `probability/entropy`, `matrix-analysis/spectral-decomposition`) are loaded on demand without redundancy. Crypto-specific concepts (OWF/PRF/CCA/reduction proofs etc.) are not among these 31 anchors; activate them via temporary knowledge cards or the crypto books.
+> **Domain Router note**: For pure cryptography, load the smallest relevant card under `cryptography/` first; consult `../references/books/` only when the anchors are insufficient or literature-level depth is requested. Shared-math anchors are loaded on demand without duplicating cryptographic semantics. A pure AI request does not enter the crypto route merely because it contains words such as “hash,” “attack,” or “security.”
 
 ## Domain Extension Index
 
@@ -51,3 +53,5 @@ Each domain has an `*/index.en.md` that lists: domain trigger signals, core anch
 | Topology | `topology/index.en.md` |
 | Probability & Information | `probability/index.en.md` |
 | Information Geometry | `information-geometry/index.en.md` |
+| Algebraic Geometry | `algebraic-geometry/index.en.md` |
+| Cryptography | `cryptography/index.en.md` |

package/knowledge-base/overview.md

@@ -4,7 +4,7 @@
 
 ## 知识库结构
 
-知识库按数学领域组织，共 7 个领域、31 张知识卡片。每张卡片包含：最小定义、核心公式、适用问题、AI 设计翻译、工程可行性、风险与失效条件。
+知识库按领域组织，共 9 个目录、37 张知识卡片：其中 8 个共享数学领域含 33 张锚点，密码学领域含 4 张专属锚点。共享数学卡按需给出 AI/工程翻译；密码学卡优先保持安全定义、构造与归约语义，不强塞 AI 或 GPU 模板。
 
 | 领域 | 目录 | 卡片 | 典型应用 |
 |------|------|------|---------|
@@ -15,6 +15,8 @@
 | 拓扑 | `topology/` | persistent-homology, euler-characteristic, fundamental-group | 拓扑正则、隐空间监控 |
 | 概率与信息 | `probability/` | concentration-inequality, entropy, kl-divergence, information-bottleneck, fisher-information | VAE、知识蒸馏、泛化界 |
 | 信息几何 | `information-geometry/` | natural-gradient, fisher-metric | 自然梯度下降、Fisher-Rao 度量 |
+| 代数几何 | `algebraic-geometry/` | grassmannian-plucker, sheaf-cohomology | 子空间参数化、局部到整体一致性 |
+| 密码学（领域专属） | `cryptography/` | prf-prg-owf, attack-game-framework, cca-cpa-ae-hierarchy, reduction-proof-template | 安全定义、构造、攻击游戏、归约证明 |
 
 ## 从问题找知识卡
 
@@ -30,13 +32,13 @@
 
 ## 当锚点不够时
 
-现有 31 个锚点覆盖 AI 研究中最常用的数学结构。当问题需要的数学工具不在其中时：
+现有 33 个共享数学锚点与 4 个密码学锚点覆盖高频结构。当问题需要的工具不在其中时：
 
 1. 查看对应领域的 `*/index.md`（如 `topology/index.md`），获取扩展概念和参考书方向
-2. 进入 `../skills/math-research-activator/SKILL.md` 中定义的**知识缺口协议**，生成临时知识卡
+2. 进入根 `../SKILL.md` 中定义的**知识缺口协议**，生成临时知识卡
 3. 不得回答"知识库未覆盖"或强行套用最相近卡片
 
-> **Domain Router 提示**（v3.2.0）：本知识库主要服务 **AI 研究层** 与 **共用数学层**。若 Domain Router 判定问题属**密码学层**，优先查阅 `../references/skill-index.md` 列出的 3 本密码学书稿；共用数学锚点（如 `probability/entropy`、`matrix-analysis/spectral-decomposition`）按需加载，不重复。密码学专属概念（OWF/PRF/CCA/归约证明等）不在此 31 锚点内，通过临时知识卡或密码学书稿激活。
+> **Domain Router 提示**：纯密码问题先加载 `cryptography/` 的最小相关锚点；只有锚点不足或用户要求文献级深度时才查 `../references/books/`。共享数学锚点按需加载且不复制密码学语义。纯 AI 问题不因出现 “hash”“attack”“security”等单词就自动进入密码学路由。
 
 ## 领域扩展索引
 
@@ -51,3 +53,5 @@
 | 拓扑 | `topology/index.md` |
 | 概率与信息 | `probability/index.md` |
 | 信息几何 | `information-geometry/index.md` |
+| 代数几何 | `algebraic-geometry/index.md` |
+| 密码学 | `cryptography/index.md` |

package/knowledge-base/probability/kl-divergence.en.md

@@ -1,7 +1,7 @@
 # KL Divergence
 
 ## Minimal Definition
-Kullback-Leibler divergence measures the **information loss** when a probability distribution $q$ is used to approximate the true distribution $p$ — that is, the average number of extra bits spent when encoding $p$ using $q$. It is not a metric (it is asymmetric and does not satisfy the triangle inequality), but it defines a natural "directional distance" on the probability simplex.
+Kullback--Leibler divergence compares the relative information in $p$ and $q$. Under the coding interpretation, it is the excess expected code length when data from $p$ are encoded with a code optimized for $q$: units are bits for $\log_2$ and nats for the natural logarithm. It is asymmetric and violates the triangle inequality, so it is not a metric.
 
 ## Core Formulas
 
@@ -12,14 +12,14 @@ $$D_{KL}(p \| q) = \sum_x p(x) \log \frac{p(x)}{q(x)} = \mathbb{E}_{p}\left[\log
 $$D_{KL}(p \| q) = \int p(x) \log \frac{p(x)}{q(x)}\, dx$$
 
 **Fundamental properties**:
-- $D_{KL}(p \| q) \geq 0$ (Gibbs' inequality), with equality if and only if $p = q$
+- $D_{KL}(p \| q) \geq 0$ (Gibbs' inequality); when $p$ is absolutely continuous with respect to $q$, equality holds iff $p=q$ almost everywhere
 - **Asymmetric**: $D_{KL}(p \| q) \neq D_{KL}(q \| p)$, hence it is not a metric
 
 **Relationship to cross-entropy and entropy**:
 $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 **Semantic difference between the two directions**:
-- **Forward KL** $D_{KL}(p \| q)$: $q$ tends to cover all modes of $p$ (mean-seeking)
+- **Forward KL** $D_{KL}(p \| q)$: when $p$ is the target and $q$ belongs to a restricted approximation family, missing regions with positive $p$ mass is heavily penalized; “mass-covering” is more precise than the context-dependent phrase “mean-seeking”
 - **Reverse KL** $D_{KL}(q \| p)$: $q$ tends to lock onto a single mode of $p$ (mode-seeking)
 
 ## Applicable Problems
@@ -37,11 +37,11 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 - **D2[~]**: KL itself is not a GEMM, but its inputs (logits) come from GEMM layers
 - **D3[v]**: $O(|\mathcal{X}|)$ linear
 - **D4[~]**: For large vocabularies, both $p$ and $q$ probability vectors must be held simultaneously; chunked computation is possible
-- **D5[v]**: Log-softmax differences are stable in bf16; note that $\log q$ diverges as $q \to 0$, requiring clamping
+- **D5[~]**: Compute from logits with `log_softmax` rather than softmax-then-log and accumulate in fp32. Arbitrary clamping changes the objective and is not an unbiased numerical fix.
 - **D8[v]**: Can be fused with softmax into FusedKLDivLoss
 
 ## Risks and Failure Conditions
-- **KL diverges to infinity when $q(x)=0$ but $p(x)>0$**: In practice, label smoothing or temperature scaling must be applied to $q$ to avoid zero probabilities. The mode-seeking behavior of reverse KL can exacerbate this issue — the student model "drops" low-probability regions of the teacher distribution.
+- **Support mismatch**: If $p(x)>0$ where $q(x)=0$, then $D_{KL}(p\|q)=\infty$. Exact softmax probabilities are positive, but finite precision can underflow; compute in log space. Smoothing is a modeling choice, not a universal requirement.
 - **High gradient variance**: In RL (PPO/RLHF), KL estimation relies on sampling; high variance can lead to training instability. A clipped + linear approximation $\mathbb{E}[\log p - \log q]$ is commonly used in place of the exact KL.
 
 ## Further References
@@ -53,7 +53,7 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 ## Routing Extensions
 - If used for IB objective -> `information-bottleneck.en.md` (IB defines objective using KL)
-- If the absolute version is needed -> `entropy.en.md` (KL divergence reduces to entropy)
+- For the cross-entropy identity -> `entropy.en.md` ($D_{KL}(p\|q)=H(p,q)-H(p)$)
 - If local KL geometry is needed -> `fisher-information.en.md` (Fisher information is local curvature of KL)
 
 ## Extensible Directions