math-skill 3.2.0 → 3.3.1

package/knowledge-base/probability/kl-divergence.md

@@ -1,7 +1,7 @@
 # KL 散度 / KL Divergence
 
 ## 最小定义
-Kullback-Leibler 散度度量一个概率分布 $q$ 相对于真实分布 $p$ 的**信息损失**——即用 $q$ 编码 $p$ 时多花的平均比特数。它不是度量（不对称、不满足三角不等式），但在概率单纯形上定义了自然的"方向性距离"。
+Kullback--Leibler 散度比较 $p$ 与 $q$ 的相对信息。满足编码解释的条件下，它等于用针对 $q$ 的码描述来自 $p$ 的样本所增加的期望码长；以 $\log_2$ 计单位为 bit，以自然对数计单位为 nat。它不对称且不满足三角不等式，因此不是距离度量。
 
 ## 核心公式
 
@@ -12,14 +12,14 @@ $$D_{KL}(p \| q) = \sum_x p(x) \log \frac{p(x)}{q(x)} = \mathbb{E}_{p}\left[\log
 $$D_{KL}(p \| q) = \int p(x) \log \frac{p(x)}{q(x)}\, dx$$
 
 **基本性质**：
-- $D_{KL}(p \| q) \geq 0$（Gibbs 不等式），等号当且仅当 $p = q$
+- $D_{KL}(p \| q) \geq 0$（Gibbs 不等式）；在 $p$ 对 $q$ 绝对连续时，等号当且仅当 $p=q$（几乎处处）
 - **不对称**：$D_{KL}(p \| q) \neq D_{KL}(q \| p)$，因此不是度量
 
 **与交叉熵/熵的关系**：
 $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 **两种方向的语义差异**：
-- **前向 KL** $D_{KL}(p \| q)$：$q$ 倾向于覆盖 $p$ 的所有模式（mean-seeking）
+- **前向 KL** $D_{KL}(p \| q)$：当 $p$ 是目标、$q$ 是受限近似族时，遗漏 $p$ 有质量的区域会受重罚，通常称 mass-covering；“mean-seeking”只是部分例子的现象
 - **反向 KL** $D_{KL}(q \| p)$：$q$ 倾向于锁定 $p$ 的某一个模式（mode-seeking）
 
 ## 适用问题
@@ -37,11 +37,11 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 - **D2[~]**：KL 本身不是 GEMM，但输入（logits）来自 GEMM 层
 - **D3[v]**：$O(|\mathcal{X}|)$ 线性
 - **D4[~]**：大 vocab 下需同时保留 $p$ 和 $q$ 的完整概率向量，可 chunk 计算
-- **D5[v]**：log-softmax 差值在 bf16 下稳定；注意 $q \to 0$ 时 $\log q$ 发散，需 clamp
+- **D5[~]**：从 logits 用 `log_softmax` 计算比先 softmax 再取 log 稳定；低精度累加宜用 fp32。任意 clamp 都会改变目标，不能当作无偏数值修复
 - **D8[v]**：可与 softmax 融合为 FusedKLDivLoss
 
 ## 风险与失效条件
-- **$q(x)=0$ 但 $p(x)>0$ 时 KL 发散为无穷**：实践中必须对 $q$ 做 label smoothing 或温度缩放，避免零概率。反向 KL 的 mode-seeking 行为可加剧此问题——学生模型"丢弃"教师分布的低概率区域。
+- **支持集不匹配**：若某处 $p(x)>0$ 而 $q(x)=0$，则 $D_{KL}(p\|q)=\infty$。softmax 的精确数学输出为正，但有限精度下可能下溢；可在 log-space 计算，是否使用 smoothing 取决于建模目标而非硬性要求。
 - **梯度方差大**：在 RL（PPO/RLHF）中，KL 估计依赖采样，高方差可导致训练不稳定。常用 clip + 线性近似 $\mathbb{E}[\log p - \log q]$ 替代精确 KL。
 
 ## 深入参考
@@ -53,7 +53,7 @@ $$D_{KL}(p \| q) = H(p, q) - H(p)$$
 
 ## 路由扩展
 - 若用于 IB 目标函数 → `information-bottleneck.md`（IB 使用 KL 定义目标）
-- 若需要绝对版本 → `entropy.md`（KL 散度退化为熵）
+- 若需要交叉熵关系 → `entropy.md`（$D_{KL}(p\|q)=H(p,q)-H(p)$）
 - 若需要局部 KL 几何 → `fisher-information.md`（Fisher 信息是 KL 的局部曲率）
 
 ## 可扩展方向

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "math-skill",
-  "version": "3.2.0",
-  "description": "面向 AI 架构创新与密码学研究的数学研究操作系统 v3.2：思想透镜 / 激活锚点 / 设计翻译原型 + Domain Router（AI/密码/纯数学/交叉），支持知识缺口协议与临时知识卡。Math Research OS for AI architecture & cryptography research: thinking lenses + activation anchors + design translation prototypes + Domain Router with Knowledge Gap Protocol.",
+  "version": "3.3.1",
+  "description": "面向 AI 架构创新与密码学研究的数学研究路由器：三层正交架构（15 透镜 / 37 锚点 / 22 设计原型）+ Domain Router + Knowledge Gap Protocol。Math research router for AI and cryptography: three-layer architecture with progressive loading and domain isolation.",
   "keywords": [
     "math",
     "mathematics",
@@ -10,49 +10,20 @@
     "claude",
     "cursor",
     "ai",
-    "axiomatization",
-    "abstraction",
-    "logic",
-    "modeling",
     "optimization",
     "probability",
-    "transformation",
     "symmetry",
-    "induction",
-    "algorithm",
+    "topology",
     "information-theory",
     "game-theory",
-    "causal-inference",
-    "topology",
-    "combinatorics",
-    "discrete-math",
-    "math-research-activator",
-    "ask",
-    "tool-selection",
-    "algebraic-geometry",
     "differential-geometry",
     "lie-theory",
-    "manifolds",
-    "category-theory",
     "matrix-analysis",
-    "gpu",
-    "tensor-core",
-    "gpu-friendly",
-    "agentic-workflow",
-    "auto-trigger",
-    "co-design",
-    "research",
-    "bilingual",
-    "lenses",
-    "knowledge-base",
-    "design-patterns",
-    "math-research-os",
     "cryptography",
     "crypto",
-    "security",
-    "reduction-proof",
-    "attack-game",
-    "domain-router"
+    "gpu-friendly",
+    "research",
+    "bilingual"
   ],
   "license": "MIT",
   "author": "the-thinker0",
@@ -67,6 +38,8 @@
   "files": [
     "README.md",
     "README.en-US.md",
+    "SKILL.md",
+    "SKILL.en.md",
     "LICENSE",
     "commands/",
     "skills/",

package/references/agentic-workflow.en.md

@@ -28,7 +28,7 @@
 
 1. **Diagnosis**: What is the algorithmic structure / bottleneck of the problem? (Do not start by piling on math tutorials.)
 2. **Cross-domain activation**: Scan `books/*.md` for transferable modern mathematical structures, **enumerate multiple candidates** (leveraging the model's large-context advantage).
-3. **Dual acceptance gate**: Each candidate passes two gates — (1) Mathematically correct (differentiable, self-consistent, with correctness guarantees); (2) GPU-feasible (the eight dimensions of `gpu-friendly-math.en.md`).
+3. **Dual acceptance gate**: Each candidate passes two gates — (1) mathematically correct, with theorems separated from assumptions and heuristics; (2) compatible with task-relevant engineering constraints. For GPU work, assess the applicable dimensions in `gpu-friendly-math.en.md` and mark the rest `N/A`.
 4. **Iterative tracking**: Record candidates, scores, and status in a markdown test plan, converging step by step.
 
 ## Markdown Test Plan Template / Tracking Template
@@ -36,7 +36,7 @@
 Record research tasks in a table that the Agent can continuously update:
 
 ```markdown
-| Candidate Structure | Math Correctness | GPU 8-Dim | Complexity | Status | Notes / Next Steps |
+| Candidate Structure | Math Correctness | Applicable GPU Dimensions | Complexity | Status | Notes / Next Steps |
 |--------------------|-----------------|-----------|------------|--------|-------------------|
 | Tropical gating replacing TopK | [v] Differentiable relaxation | 1[v]2[x]3[v]… | Sub-quadratic (per-token) | Verifying | Compare with SWA baseline |
 | …                  |                 |           |            | Todo   |                   |

package/references/agentic-workflow.md

@@ -30,7 +30,7 @@
 
 1. **诊断**：问题的算法结构 / 瓶颈是什么？（不要一上来堆数学科普。）
 2. **跨域激活**：用 `books/*.md` 扫描可迁移的现代数学结构，**枚举多个候选**（发挥模型大上下文优势）。
-3. **双验收门**：每个候选过两关——① 数学正确（可微、自洽、有保证）；② GPU 可行（`gpu-friendly-math.md` 八维）。
+3. **双验收门**：每个候选过两关——① 数学正确（区分定理、假设与启发式）；② 满足任务相关的工程约束。涉及 GPU 时按 `gpu-friendly-math.md` 评估相关维度，无关项标 `N/A`。
 4. **迭代追踪**：用 markdown testplan 记录候选、评分、状态，逐步收敛。
 
 ## markdown testplan 模板 / Tracking Template
@@ -38,7 +38,7 @@
 把研究任务写进一张可被 Agent 持续更新的表：
 
 ```markdown
-| 候选结构 | 数学正确性 | GPU 八维 | 复杂度 | 状态 | 备注/下一步 |
+| 候选结构 | 数学正确性 | 相关 GPU 维度 | 复杂度 | 状态 | 备注/下一步 |
 |---------|-----------|---------|-------|------|-----------|
 | 热带门控替代 TopK | [v] 可微松弛 | 1[v]2[x]3[v]… | 亚二次(逐token) | 验证中 | 对比 SWA 基线 |
 | …            |           |         |       | 待办 |           |

package/references/books/abstract-algebra.en.md

@@ -52,41 +52,30 @@ Actual chapter map (grouped by topic; chapter numbers taken from the book's tabl
 
 1. **G-equivariant layer** (source: 5, 6, 10): Implement the symmetry group G's action as permutation/rotation matrices rho(g), with weights shared along orbits, enforcing f(g x)=rho(g) f(x). In practice, for each g in G the input is transformed by rho(g) then passed through the same set of weights, and the results are aggregated -- equivalent to expanding the convolution kernel into a [\|G\|, C_out, C_in] batched GEMM, reducing independent parameters by a factor of \|G\|. Deployed models: CNN (translation), G-CNN (D_n steerable filters), DeepSets/Set Transformer (S_n), E(3)-equivariant GNN (point clouds/molecules).
 2. **Tropical / min-plus attention and routing** (source: 12-14 ring axiom relaxation): Replace softmax's (x,)+exp with (+, min/max) min-plus matmul: score(+) = min_k(Q_ik + K_kj). Hard Top-K routing -> tropical semiring **piecewise-linear gating** (sub-differentiable -- breakpoints need LogSumExp smoothing, which recovers standard softmax; an alternative to the non-differentiable argmax). Viterbi, DTW, and shortest paths are all instances of this min-plus matmul -- see the Tropical Gating example in `../gpu-friendly-math.en.md` (used only for low-dimensional gating and **not on Tensor Cores** -- max/min runs on CUDA cores, while the main trunk still uses standard (x,+) GEMM).
-3. **Permutation-invariant aggregation** (source: 9, 29): Quotienting by the S_n action yields sum/max/mean pooling -- naturally O(n) and parallel-friendly, the algebraic foundation for DeepSets rho(Sigma phi(x_i)) and GNN message passing. Burnside counting (Ch 29) can estimate "how many essentially distinct configurations exist" at design time, for predicting parameter savings and data deduplication benefits.
-4. **Finite-field coding for Infra** (source: 22, 31): Linear codes c=mG (generator matrix G over GF(q)) for fault-tolerant storage and gradient compression, with Hamming distance providing a lower bound on error-correcting capability; Shamir secret sharing (polynomial interpolation over GF(p), recoverable from t shards) for secure aggregation in federated learning; finite-field hashing/CRC for deduplication and consistency verification. Commonality: pure int/bitwise operations, placed in pre/post-processing on data flows.
+3. **Permutation-invariant aggregation** (sources 9, 29): sum/max/mean are permutation invariant. DeepSets' `rho(sum phi(x_i))` has representation results under stated conditions. Burnside's lemma counts orbits of finite group actions exactly; orbit counts become resource estimates only when the sharing or deduplication scheme identifies precisely those orbits.
+4. **Finite-field coding for infrastructure** (sources 22, 31): linear codes `c=mG` support fault-tolerant storage and coded computation, while Hamming distance determines error detection/correction capability. Shamir sharing can be one component of secure aggregation, but privacy also depends on thresholds, dropouts, authentication, and the threat model. CRC detects accidental errors; it is not cryptographic collision resistance.
 5. **Cyclic group representations -> Frequency-domain token mixing** (source: 4, 11): The irreducible representations of Z_n are the DFT basis, giving rise to FFT convolution (O(n log n) replacing O(n^2)), RoPE (encoding positions as SO(2) rotations, i.e., unitary representations of Z), and cyclic/relative positional encodings. The finite abelian group classification theorem (Ch 11) guarantees that any such periodic structure can be decomposed into cyclic components for FFT.
 6. **Fourier / spectral methods on groups** (source: 10 homomorphism + 4/11): Extending the irreducible decomposition of representation theory to general finite groups yields the group convolution theorem -- spectral GNNs and spherical CNNs (harmonic analysis on SO(3)) are special cases; the cost is that fast transforms for non-abelian groups may not exist and complexity must be assessed.
 
 ## GPU Friendliness Warning
 
-> The sole source for eight-dimension criteria and scoring rules: `../gpu-friendly-math.en.md` (Tensorization / GEMM-mappability / Complexity / Memory / Low-precision / Parallelism / Sparsity / Operator fusion). Here we give only per-dimension verdicts for the book's structures.
+> Only implementation questions should use the applicable dimensions in `../gpu-friendly-math.en.md`; an algebraic structure has no universal GPU-friendly/unfriendly label.
 
-**Focus A: Can semiring GEMM run on Tensor Cores? -- Not by default.**
+- **Min/max-plus matrix multiplication:** standard Tensor Core MAC does not natively implement the semiring operations; the naive dense algorithm is O(n^3). Faster possibilities depend on the model and value domain, so compare problem-specific kernels at the target scale.
+- **Numerics and gradients:** max/min avoids exponential overflow, but additions, infinity sentinels, ties, and low-precision comparisons still matter. Max/min is differentiable almost everywhere and admits subgradients; log-sum-exp is a smooth approximation that changes exact semiring semantics, not an equivalent ordinary GEMM.
+- **Group actions:** permutations may use indexing/gather, while larger representations may use dense or sparse operators. Performance depends on shape, reuse, and memory access. Low precision can also drift from exact orthogonal/unitary invariants.
+- **Finite-field arithmetic:** typically uses integer, bitwise, lookup, or dedicated kernels rather than floating-point Tensor Core MAC. It may appear in training-related protocols or coding, but non-differentiable paths must be separated explicitly from gradients.
+- **Avoid explicit enumeration of large groups:** for example, |S_n|=n!. Generators, orbits, or problem-specific parameterizations can help, but preservation of the required equivariance must be proved.
 
-- **D2 GEMM-mappability ([x] unfriendly)**: Tensor Core hardware only performs (x,+) MAC (fp16/bf16/fp8 accumulated into fp32). Min-plus / max-plus uses (+, min/max), which is **not natively supported**; naive tropical GEMM degenerates to CUDA core scalar comparisons and cannot leverage Tensor Cores.
-- **D3 Complexity ([x])**: Min-plus matrix multiplication has no Strassen-style sub-cubic speedup (equivalent to the APSP hard problem); naive O(n^3).
-- **D5 Low-precision ([v])**: Tropical uses max/min, no exp overflow risk; numerically robust.
-- **D8 Differentiability / Operator fusion ([~] adaptable)**: min/max is non-differentiable; requires relaxation.
-- **Adaptations (-> eight-dimension friendly)**: (1) log-sum-exp smoothing of min/max recovers (x,+) stable softmax, back on Tensor Cores; (2) confine tropical operations **to low-dimensional gating only**, keeping the main trunk on standard (x,+) GEMM (the Tropical Gating example in the reference file = D1 [v] Tensorization / D2 [x] not Tensor Core GEMM / D3 [v] per-token gating sub-quadratic, D8 needs LogSumExp smoothing); (3) blocking -- standard GEMM within blocks, min-plus reduction between blocks.
-
-**Focus B: Can group operations be tensorized? -- Small groups yes, large groups and exact arithmetic no.**
-
-- **Finite group actions (D1/D2 [v])**: Permutation matrices / dense representation matrices -> batched GEMM; G-CNN has been engineered. Orthogonal rotation/permutation matrices are numerically stable under bf16 (D5 [v]).
-- **Large group enumeration (D3/D4 [x])**: \|S_n\|=n! explodes; explicitly enumerating group elements -> memory and compute blow up. **Adaptation**: Use only generators (Ch 26 Generators and Relations) + Cayley graphs (Ch 30) for local propagation, without materializing the entire group.
-- **Permutation = gather/scatter (D7/D1/D8 [x])**: Implementation as irregular gather/scatter causes warp divergence. **Adaptation**: Pre-compile fixed permutation patterns into structured sparsity or dense indexing.
-- **Finite fields / modular arithmetic (D2 [x], D1/D6 [v])**: mod p, GF(2^n), XOR, table lookups **are not floating-point MAC** and cannot use Tensor Cores, but are highly parallel on int/bitwise kernels. Conclusion: **suitable for pre/post-processing in coding/hashing, never to be placed in the training main-trunk GEMM**. Galois / exact-field arithmetic requires int, is non-differentiable, violating D8.
-
-**Scoring conclusion**: Group equivariance (small groups, dense representations) and frequency-domain structures = mathematical beauty x GPU friendliness, can enter the main trunk; semirings, finite fields, exact Galois = require relaxation/isolation first, otherwise can only serve as auxiliary operators or offline tools.
-
-**Worked example comparison (candidate x eight-dimension verdict):**
+**Candidate comparison example (benchmark before accepting):**
 
 | Candidate design | Algebraic source (Ch) | Key dimension verdicts | Enter main trunk? |
 |---|---|---|---|
-| Equivariant layer (small groups D_n/S_n, permutation+rotation matrices) | 5, 6, 10 | 1[v] 2[v] 5[v], large groups 3/4[x] | [v] (limited to small groups/generators) |
-| Tropical gating (low-dim min-plus replacing hard Top-K) | 12-14 relaxation | 1[v] 2[v] 8 needs relaxation, main trunk still (x,+) | [v] (gating only) |
-| Pure min-plus main-trunk attention | 12-14 relaxation | 2[x] Tensor Core unsupported, 3[x] O(n^3) | [x] (needs log-sum-exp smoothing first) |
-| Finite-field coding for KV/gradient compression | 22, 31 | 2[x] not floating-point MAC, 1/6[v] int parallel | [x] main trunk / [v] pre/post-processing |
-| Cyclic group representations (FFT/RoPE token mixing) | 4, 11 | 1[v] 2[v] 3[v] (n log n) | [v] |
+| Equivariant layer (finite groups or low-dimensional representations) | 5, 6, 10 | Compare indexed, dense, and sparse implementations; measure equivariance error | Depends on group, representation, and shape |
+| Tropical gating (low-dimensional min/max-plus) | 12-14 | Define tie gradients, complexity, and a kernel | Exploratory; ablate first |
+| Dense min-plus matrix multiplication | 12-14 | Not native Tensor Core MAC; naive O(n^3) | Benchmark only if scale and semantics justify it |
+| Finite-field coding for KV/gradient compression | 22, 31 | Non-floating MAC; coding gain must exceed movement/decode cost | End-to-end benchmark first |
+| Cyclic convolution/FFT; RoPE | 4, 11 | FFT may be O(n log n); RoPE uses elementwise rotations, not the same kernel | Evaluate separately |
 
 ## Which Thinking Lens to Invoke
 
@@ -96,13 +85,13 @@ Actual chapter map (grouped by topic; chapter numbers taken from the book's tabl
 - **Secondary: `duality`** -- homomorphisms/isomorphisms as equivalence transformations, FFT/frequency-domain transforms to simplify problems.
 - **Secondary: `algorithmic`** -- finite group counting (Burnside, Ch 29), coding (Ch 31), finite field enumeration (Ch 22).
 
-Typical combination chain: First `symmetry` to identify the group and invariants in the problem -> `categorical` to extract the common algebraic structure -> `axiomatization` to verify axioms truly hold (guard against false symmetry, guard against misusing subtraction) -> `duality` to realize as a learnable linear map -> finally pass through the `../gpu-friendly-math.en.md` eight-dimension acceptance gate.
+Typical combination chain: use `symmetry` to identify groups and invariants -> `categorical` to extract common algebraic structure -> `axiomatization` to verify the axioms -> `duality` to obtain a learnable representation -> for implementation work, inspect the applicable GPU dimensions and benchmark.
 
 ## Anti-patterns
 
-- **Forcing "group elegance" into the main trunk without Tensor Core support**: tropical / finite-field arithmetic used as GEMM, actually runs as CUDA core scalar throughout.
+- **Treating an algebraic name as a hardware mapping:** tropical or finite-field operations do not become standard Tensor Core GEMM merely because they are written as matrix products; inspect the actual kernel.
 - **Enumerating the entire group** instead of using generators (\|S_n\|=n! / \|GL\| blows memory).
-- **Insisting on exact Galois / finite-field structures**: leads to non-differentiability, requires int, blocks end-to-end gradients.
+- **Failing to isolate exact finite-field paths:** integer/bit operations are not differentiable; a training system must state whether they are outside the gradient path or use an estimator.
 - **Over-constraining with symmetry**: writing "approximately symmetric / pseudo-symmetric" patterns as hard equivariance, stifling expressiveness and model exploration (echoing the agentic-workflow principle of "don't hardcode subjective biases").
 - **Confusing rings with semirings**: assuming additive inverses exist for subtraction/inversion, which fails under min-plus -> correctness errors.
 - **Building a pile of modules for "group elegance"**: when existing equivariant libraries/FFT suffice, don't create new skills; first exhaust existing model capabilities, then add structure (echoing the agentic-workflow principle of "don't create a bunch of skills right away").
@@ -120,5 +109,5 @@ Typical combination chain: First `symmetry` to identify the group and invariants
 - **Ch 22 Finite Fields** -- GF(p^n) construction and arithmetic: the foundation for coding/hashing/secure aggregation.
 - **Ch 29 Symmetry and Counting** -- Burnside counting: estimating equivalence class count / parameter savings.
 - **Ch 31 Introduction to Algebraic Coding Theory** -- Hamming codes, linear codes over finite fields (generator matrix, Hamming distance/weight): compression and fault tolerance.
-- **Ch 32 An Introduction to Galois Theory** -- The symmetry group of field extensions: an exemplar of structured transformations (deployment requires passing the GPU gate first).
+- **Ch 32 An Introduction to Galois Theory** -- symmetry groups of field extensions; an algorithmic use needs an explicit computable representation and task-relevant engineering evaluation.
 - (Semiring relaxation starting point: Ch 12-14 ring axioms -> drop additive inverse -> tropical semiring.)

package/references/books/abstract-algebra.md

@@ -52,41 +52,30 @@
 
 1. **群等变层 G-equivariant layer**（源：5, 6, 10）：把对称群 G 的作用实现为置换/旋转矩阵 ρ(g)，权重沿轨道共享，约束 f(g·x)=ρ(g)·f(x)。实现上对每个 g∈G 把输入用 ρ(g) 变换后过同一组权重，再聚合——相当于把卷积核扩成 [\|G\|, C_out, C_in] 的 batched GEMM，独立参数量 ↓\|G\| 倍。落地模型：CNN（平移）、G-CNN（Dₙ steerable filter）、DeepSets/Set Transformer（Sₙ）、E(3)-等变 GNN（点云/分子）。
 2. **热带 / min-plus 注意力与路由**（源：12–14 环公理松弛）：把 softmax 的 (×,+)+exp 换成 (+, min/max) 的 min-plus matmul：score⊕=min_k(Q_ik+K_kj)。硬 Top-K 路由 → 热带半环**分段线性门控**（次可微——折点需 LogSumExp 软化，软化后退回标准 softmax；替代不可微的 argmax）。Viterbi、DTW、最短路本质都是这条 min-plus matmul——见 `../gpu-friendly-math.md` 的 Tropical Gating 范例（只在低维门控用、且**不上 Tensor Core**——max/min 落 CUDA core，主干仍走标准 (×,+) GEMM）。
-3. **置换不变聚合 permutation-invariant aggregation**（源：9, 29）：对 Sₙ 作用取商即得 sum/max/mean pooling——天然 O(n) 且并行友好，是 DeepSets ρ(Σφ(xᵢ)) 与 GNN message passing 的代数基础。Burnside 计数（29）可在设计期估"本质不同的配置有多少"，用于预测参数节省比与数据去重收益。
-4. **有限域编码做 Infra**（源：22, 31）：线性码 c=mG（生成矩阵 G 在 GF(q) 上）做容错存储与梯度压缩，Hamming 距离给纠错能力下界；Shamir 秘密共享（GF(p) 多项式插值，t 个分片可恢复）做联邦学习安全聚合；有限域哈希/CRC 做去重与一致性校验。共性：纯 int/bitwise，放数据流前后处理。
+3. **置换不变聚合 permutation-invariant aggregation**（源：9, 29）：sum/max/mean 都是置换不变聚合；DeepSets 的 `ρ(Σφ(xᵢ))` 有相应表示定理，但具体条件需另述。Burnside 引理能精确计数有限群作用的轨道；只有参数共享或去重方案确实按这些轨道识别等价对象时，轨道数才可转成资源估计。
+4. **有限域编码做 Infra**（源：22, 31）：线性码 `c=mG` 可用于容错存储或编码计算；Hamming 距离决定可检测/纠正的错误数。Shamir 秘密共享可作为安全聚合协议的组件，但隐私还取决于参与方阈值、掉线、认证和威胁模型。CRC 适合误码检测，不提供密码学抗碰撞性。
 5. **循环群表示 → 频域 token mixing**（源：4, 11）：Zₙ 的不可约表示即 DFT 基，催生 FFT 卷积（O(n log n) 取代 O(n²)）、RoPE（把位置编成 SO(2) 旋转、即 Z 上的酉表示）、循环/相对位置编码。有限阿贝尔群分类定理（11）保证任意此类周期结构都可分解成循环分量做 FFT。
 6. **群上的傅里叶 / 谱方法**（源：10 同态 + 4/11）：把表示论的不可约分解推广到一般有限群，得到群卷积定理——谱 GNN、球面 CNN（SO(3) 上的调和分析）即其特例；代价是非阿贝尔群的快速变换不一定存在，需评估复杂度。
 
 ## GPU 友好性警告
 
-> 八维标准与判分规则唯一来源：`../gpu-friendly-math.md`（张量化 / GEMM 可映射 / 复杂度 / 显存 / 低精度 / 并行 / 稀疏 / 算子融合）。此处只给本书结构的逐维裁决。
+> 仅在实现问题中按 `../gpu-friendly-math.md` 评估相关维度；代数结构本身没有统一的“GPU 友好/不友好”标签。
 
-**焦点 A：半环 GEMM 能上 Tensor Core 吗？——默认不能。**
+- **min/max-plus 矩阵乘**：标准 Tensor Core MAC 不原生支持其半环运算；朴素稠密算法为 O(n³)。是否有更快算法依模型与数值域而定，工程上应与专用 kernel 和问题规模基准比较。
+- **数值与梯度**：max/min 避免指数上溢，但加法、无穷元表示、tie 和低精度比较仍会出问题。max/min 几乎处处可微且可用次梯度；log-sum-exp 是平滑近似，会改变精确半环语义，并不“退回普通 GEMM”等价计算。
+- **群作用**：置换常可用索引/gather，高维表示可用稠密或稀疏算子；哪种更快取决于形状、复用和内存访问。低精度也可能破坏理论上的正交/酉约束，需测不变量漂移。
+- **有限域运算**：通常走整数、位运算、查表或专用 kernel，不使用浮点 Tensor Core MAC；它可出现在训练相关协议或编码中，但不可微部分需要与梯度路径明确隔离。
+- **禁止显式枚举大群**：例如 |Sₙ|=n!；可考虑生成元、轨道或问题特定参数化，但这些替代是否保持所需等变性必须证明。
 
-- **D2 GEMM 可映射（[x]不友好）**：Tensor Core 硬件只做 (×,+) 的 MAC（fp16/bf16/fp8 累加到 fp32）。min-plus / max-plus 用的是 (+, min/max)，**非原生**，朴素 tropical GEMM 退化到 CUDA core 标量比较，吃不到 Tensor Core。
-- **D3 复杂度（[x]）**：min-plus 矩阵乘没有 Strassen 式亚立方加速（等价于 APSP 难题），朴素 O(n³)。
-- **D5 低精度（[v]）**：tropical 用 max/min，无 exp 上溢，反而数值稳健。
-- **D8 可微/融合（[~]可改造）**：min/max 不可微，需松弛。
-- **改造（→ 八维转友好）**：① log-sum-exp 软化 min/max 退回 (×,+) 稳定 softmax，重上 Tensor Core；② 把热带运算**只放在低维门控**，主干仍走标准 (×,+) GEMM（范例文件中 Tropical Gating = D1[v] / D2[x] 非 Tensor Core GEMM / D3[v] 逐 token 门控亚二次，D8 需 LogSumExp 软化）；③ 分块——块内标准 GEMM、块间 min-plus 归约。
-
-**焦点 B：群操作能张量化吗？——小群能，大群和精确算术不能。**
-
-- **有限群作用（D1/D2 [v]）**：置换矩阵 / 稠密表示矩阵 → batched GEMM，G-CNN 已工程化。正交的旋转/置换矩阵在 bf16 下数值稳定（D5 [v]）。
-- **大群枚举（D3/D4 [x]）**：\|Sₙ\|=n! 爆炸，显式枚举群元素 → 显存与算力爆。**改造**：只用生成元（26 Generators and Relations）+ Cayley 图（30）做局部传播，不物化整群。
-- **置换 = gather/scatter（D7/D1/D8 [x]）**：实现为不规则 gather/scatter 会 warp divergence。**改造**：固定置换模式预编译为结构化稀疏或 dense 索引。
-- **有限域 / 模算术（D2 [x]、D1/D6 [v]）**：mod p、GF(2ⁿ)、XOR、查表**不是浮点 MAC**，吃不到 Tensor Core，但在 int/bitwise kernel 上高并行。结论：**适合放编码/哈希的前后处理，绝不放进训练主干 GEMM**。Galois/精确域算术要求 int、不可微，违反 D8。
-
-**判分结论**：群等变（小群、稠密表示）与频域结构 = 数学美 × GPU 友好，可进主干；半环、有限域、精确 Galois = 需先松弛/隔离，否则只能当辅助算子或离线工具。
-
-**范例对照（候选 × 八维裁决）**：
+**候选比较示例（结论须由基准确认）**：
 
 | 候选设计 | 代数来源（章） | 关键维度裁决 | 进主干？ |
 |---|---|---|---|
-| 群等变层（小群 Dₙ/Sₙ，置换+旋转矩阵）| 5, 6, 10 | 1[v] 2[v] 5[v]，群大时 3/4[x] | [v]（限小群/生成元）|
-| 热带门控（低维 min-plus 取代硬 Top-K）| 12–14 松弛 | 1[v] 2[v] 8 需松弛，主干仍 (×,+) | [v]（仅门控）|
-| 纯 min-plus 主干注意力 | 12–14 松弛 | 2[x] Tensor Core 不支持、3[x] O(n³) | [x]（先 log-sum-exp 软化）|
-| 有限域编码压缩 KV/梯度 | 22, 31 | 2[x] 非浮点 MAC，1/6[v] int 并行 | [x]主干 / [v]前后处理 |
-| 循环群表示（FFT/RoPE token mixing）| 4, 11 | 1[v] 2[v] 3[v]（n log n）| [v] |
+| 群等变层（有限群或低维表示）| 5, 6, 10 | 比较索引、稠密与稀疏实现；测等变误差 | 取决于群、表示与形状 |
+| 热带门控（低维 min/max-plus）| 12–14 | 需定义 tie 梯度、复杂度和专用 kernel | 探索性；先消融 |
+| 稠密 min-plus 矩阵乘 | 12–14 | 标准 Tensor Core 不原生支持；朴素 O(n³) | 仅在规模/语义需要时评测 |
+| 有限域编码压缩 KV/梯度 | 22, 31 | 非浮点 MAC；编码收益须覆盖搬运与解码成本 | 先做端到端基准 |
+| 循环卷积/FFT；RoPE | 4, 11 | FFT 可 O(n log n)；RoPE 是逐元素旋转，二者不是同一 kernel | 分别评测 |
 
 ## 该调用哪个思想透镜
 
@@ -96,13 +85,13 @@
 - **副：`duality`**——同态/同构作等价转换、FFT/频域变换简化问题。
 - **副：`algorithmic`**——有限群计数（Burnside, 29）、编码（31）、有限域枚举（22）。
 
-典型组合链：先 `symmetry` 识别问题里的群与不变量 → `categorical` 抽出公共代数结构 → `axiomatization` 核对公理是否真成立（防伪对称、防误用减法）→ `duality` 落成可学习线性映射 → 最后过 `../gpu-friendly-math.md` 八维门。
+典型组合链：先 `symmetry` 识别问题里的群与不变量 → `categorical` 抽出公共代数结构 → `axiomatization` 核对公理是否真成立（防伪对称、防误用减法）→ `duality` 落成可学习表示 → 若涉及实现，再检查相关 GPU 维度并做基准。
 
 ## 反模式
 
-- **把"群之美"硬塞进主干却吃不到 Tensor Core**：tropical / 有限域算术当 GEMM 用，实测全程 CUDA core 标量。
+- **把代数名称当硬件映射**：tropical 或有限域运算不能因写成“矩阵乘”就假定使用标准 Tensor Core GEMM；必须查看实际 kernel。
 - **枚举整群**而非用生成元（\|Sₙ\|=n! / \|GL\| 爆显存）。
-- **死磕精确 Galois / 有限域结构**：导致不可微、必须 int、阻断端到端梯度。
+- **未隔离精确有限域路径**：整数/位运算本身不可微；若它参与训练系统，应明确它是否位于梯度路径之外或使用了何种估计器。
 - **过度对称约束**：把"近似对称/伪对称"写成硬等变，扼杀表达力与模型探索（呼应 agentic-workflow 的"别把主观偏见写死"）。
 - **混淆环与半环**：默认有加法逆元做减法/求逆，到 min-plus 上不成立 → 正确性出错。
 - **为"群之美"造一堆模块**：能用现成等变库/FFT 时不要新造 skill；先用足模型已有能力，再补结构（呼应 agentic-workflow "不要一来就造一堆 skill"）。
@@ -120,5 +109,5 @@
 - **Ch 22 Finite Fields**——GF(pⁿ) 构造与算术：编码/哈希/安全聚合的底座。
 - **Ch 29 Symmetry and Counting**——Burnside 计数：估等价类数 / 参数节省。
 - **Ch 31 Introduction to Algebraic Coding Theory**——Hamming 码、有限域上的线性码（生成矩阵、Hamming 距离/权重）：压缩与容错。
-- **Ch 32 An Introduction to Galois Theory**——域扩张的对称群：结构化变换的范例（落地需先过 GPU 门）。
+- **Ch 32 An Introduction to Galois Theory**——域扩张的对称群；若用于算法设计，须另给可计算表示与任务相关的工程评估。
 - （半环松弛起点：Ch 12–14 环公理 → 去加法逆元 → 热带半环。）

package/references/books/algebraic-geometry-rising-sea.en.md

@@ -145,7 +145,7 @@ First the overview mapping, then detailed expansion:
 
 ## Anti-patterns
 
-- **Putting abstract/derived-functor cohomology directly into the training forward pass**: symbolic computation, gradient-free, not computable -- the classic "beautiful but not computable," violating the GPU eight dimensions. Use Cech + fixed covers with differentiable proxies.
+- **Putting abstract/derived-functor cohomology directly into a training forward pass** usually lacks a direct differentiable and efficient implementation. A Cech complex or fixed cover is only a problem-dependent discrete proxy; its scale complexity, approximation semantics, and empirical value must still be validated.
 - **Introducing the full Scheme/Proj machinery to "look advanced"** when the task only needs a graph Laplacian: over-engineering, violating "Simplicity First." Ask first: "does a trivial sheaf (= standard GNN) suffice?"
 - **Treating Zariski topology / generic points and other discrete structures as differentiable objects** to optimize: type error.
 - **Making Cech covers dynamic with unstructured overlaps**: degenerates into random memory access, destroying GPU parallelism (D7).

package/references/books/algebraic-geometry-rising-sea.md

@@ -113,7 +113,7 @@
 ## GPU 友好性警告
 
 > **必读且唯一权威**：`../gpu-friendly-math.md`
-> 八维记分卡：①张量化 ②GEMM 可映射 ③复杂度 ④显存/KV ⑤低精度稳定 ⑥并行与通信 ⑦稀疏结构 ⑧算子融合。
+> 完整实现审查可考虑张量化、GEMM 映射、复杂度、显存、低精度、并行通信、稀疏和融合；具体候选只展开相关项，其余标 `N/A`。
 > **数学美 ≠ 可算**；任一维"不友好且不可改造"即淘汰。
 
 **可落 GEMM / 亚二次（友好 [v]）：**
@@ -145,7 +145,7 @@
 
 ## 反模式
 
-- **把抽象/导出函子上同调直接塞进训练 forward**：符号计算、无梯度、不可算 —— 经典"美但不可算"，违反 GPU 八维。要用 Čech + 固定覆盖的可微替身。
+- **把抽象/导出函子上同调直接塞进训练 forward**：通常缺少直接可微且高效的实现；Čech 复形或固定覆盖只能作为问题相关的离散代理，仍须给出规模复杂度、近似语义和验证实验，不能默认它既便宜又保持原理论含义。
 - **为"显得高级"引入整套 Scheme/Proj 机械**，而任务其实只需要一个图拉普拉斯：过度工程，违反 CLAUDE.md「Simplicity First」。先问"是否只需平凡层（= 普通 GNN）？"
 - **把 Zariski 拓扑 / generic point 等离散结构当可微对象**优化：类型错误。
 - **让 Čech 覆盖动态化、交叠非结构化**：退化成随机访存，毁掉 GPU 并行（维度⑦）。

package/references/books/applied-cryptography.en.md

@@ -0,0 +1,112 @@
+# Applied Cryptography
+
+> Dan Boneh and Victor Shoup, *A Graduate Course in Applied Cryptography* (v0.4, 2017). A graduate-level reference organized around **attack games and reduction proofs**—a practical guide to constructions, reductions, and protocol analysis.
+
+## Overview
+
+The book treats cryptography as the mathematical study of adversarial systems. Security is defined by a formal **attack game** between a challenger and an adversary: a scheme is secure when no efficient adversary wins with non-negligible advantage. Its proofs are reductions: an attack on scheme Y is transformed into an algorithm for solving hard problem X.
+
+**Activation boundary:** This is a construction-and-proof reference, not an implementation manual. Side channels, constant-time code, and protocol state machines require implementation-focused material as well. Use this distillation to locate security definitions, reduction patterns, and common proof failures.
+
+## Core Structures and Cross-Domain Boundaries
+
+| Cryptographic structure | What transfers—and what does not |
+|---|---|
+| **Attack games (§2)** | Formalize the adversary, interface, and winning event. This discipline can inform ML threat modeling, but cryptographic game names and negligible advantage do not transfer automatically. |
+| **Reduction template (§3)** | “Break my scheme ⇒ solve a hard problem”; makes security relative to explicit assumptions. |
+| **Sequences of games and Difference Lemma (§3.4–3.5)** | Decompose a proof into bounded transitions; the probabilistic form of hybrid reasoning. |
+| **CPA/CCA/AE hierarchy (§4)** | Hierarchy of encryption-oracle capabilities; not equivalent to black-box, white-box, or gradient access in ML. |
+| **PRG/PRF/PRP constructions (§5, §14)** | Constructions and reductions among cryptographic primitives. Similarity to boosting is only structural and does not transfer a proof. |
+| **DDH/CDH/DL assumptions (§6)** | A concrete example of carefully ordering and minimizing assumptions. |
+| **Encrypt-then-MAC composition (§7.9, §9.2)** | Composition does not preserve security automatically; independent keys and context binding matter. |
+| **Sigma protocols and Fiat–Shamir (§11)** | Commitment–challenge–response, underlying Schnorr-style signatures and many noninteractive proof constructions. |
+| **AKE and forward secrecy (§12)** | Formal treatment of session-key security and compromise models. |
+| **Reduction tightness (§10.3)** | If the loss scales with a query factor Q, parameters must compensate for it. |
+
+**Activation families:**
+
+- **Definitions (§2, §4):** attack games, semantic/CPA/CCA security, and authenticated encryption.
+- **Reductions (§3, §16):** black-box wrappers, game sequences, hybrids, and simulation.
+- **Primitives (§5, §14):** OWF, PRG, PRF, PRP, collision-resistant hashing, and trapdoor functions.
+- **Protocols (§9, §11, §12):** public-key encryption, signatures, Sigma protocols, and authenticated key exchange.
+
+## Key Facts
+
+- **Align the advantage convention first (§2.2):** two-experiment differences, `|Pr[b'=b]-1/2|`, and twice that quantity all occur in the literature.
+- **PPT and negligible functions (§2.3):** this is asymptotic language. `poly · negl = negl`, but that does not make an event practically impossible at a fixed parameter.
+- **PRP switching:** for Q queries to an n-bit permutation/function interface, a common bound is on the order of `Q²/2^(n+1)`, subject to the exact advantage convention.
+- **Perfect secrecy:** under the standard finite-space assumptions, Shannon's bound requires `|K| ≥ |M|`.
+- **IND-CPA already permits repeated encryption-oracle queries:** single- and multi-challenge formulations are commonly related by hybrids under matching randomness and message restrictions.
+- **Encrypt-then-MAC has broad composition theorems:** security of MAC-then-encrypt or encrypt-and-MAC depends on the concrete encoding, primitives, and error leakage; neither should be rejected by slogan alone.
+- **Authenticated encryption combines confidentiality and ciphertext integrity:** exact implications depend on the selected games.
+- **Random self-reducibility of discrete logarithm:** an algorithm for random instances can be converted to one for arbitrary instances in the same group setting.
+- **ROM reductions may lose a hash-query factor:** concrete parameters must account for the actual loss.
+- **Quantum threat model:** Shor affects factoring and discrete-log systems; Grover gives a generic square-root query improvement in an ideal black-box model, but concrete quantum resources require separate analysis.
+
+## Suitable Questions
+
+- Write a security game: what can the adversary query, and what counts as winning?
+- Construct a reduction and check whether the simulation is faithful and tight.
+- Review EtM/MtE/EaM composition, key separation, and transcript/identity binding.
+- Convert reduction loss and query limits into concrete parameter requirements.
+- Diagnose protocol failures involving identity binding, downgrade, reflection, nonce reuse, or key reuse.
+- For AI×crypto work, transfer the discipline of explicit adversaries and interfaces; claim a cryptographic reduction only when a security parameter, hard problem, and executable reduction are actually defined.
+
+## Possible Design Inspiration
+
+1. **Adversarial modeling:** use an attack-game structure to specify an ML robustness goal, without inheriting cryptographic guarantees by analogy.
+2. **PRF as a keyed pseudorandom source:** useful for reproducible keyed seeds only under an explicit key-exposure and query model; implementations are normally not GEMMs.
+3. **Sigma protocols to verifiable computation:** proof systems may make a computation independently checkable, but prover and verifier costs depend heavily on the system.
+4. **Reduction discipline for cross-domain security:** ordinary robustness bounds are not cryptographic reductions.
+5. **Commitments for artifact binding:** a commitment can bind a model digest, but does not by itself provide watermark robustness, ownership, or traceability.
+
+## Implementation and GPU Boundary
+
+Pure cryptography does not use the GPU checklist as a security gate. When implementation performance is requested, inspect only the relevant dimensions in `../gpu-friendly-math.en.md`.
+
+- AES and SHA implementations commonly use bit operations, SIMD, CPU ISA extensions, or dedicated GPU kernels. AES-NI and SHA extensions are CPU features; non-GEMM does not mean unaccelerated.
+- RSA and other large-integer arithmetic use bigint kernels rather than ordinary tensor algebra.
+- Elliptic-curve scalar multiplication uses finite-field and point operations, not standard GEMM.
+- SNARK prover/verifier costs vary by system; common kernels include finite-field arithmetic, multiscalar multiplication, pairings, and hashes—not a generic GEMM.
+
+Avoid treating AES/SHA as matrix multiplication, putting cryptographic primitives into a hot training loop without measurement, or using a nondifferentiable cryptographic hash as an ML loss.
+
+## Relevant Thinking Lenses
+
+- **`game`:** attack games, multi-party interaction, and adversarial strategy.
+- **`axiomatization`:** security definitions and explicit assumptions.
+- **`algorithmic`:** a reduction as an algorithm transformation; resource accounting.
+- **`probabilistic`:** advantage, negligible functions, birthday bounds, and hybrids.
+- **`duality`:** information-theoretic vs computational security; adversary vs simulator.
+- **`categorical`:** implication relations among primitives, used carefully as a partial order of constructions.
+
+## Anti-Patterns
+
+- Treating a random-oracle-model proof as an absolute standard-model guarantee.
+- Confusing necessary with sufficient conditions, such as equating key-space size with security.
+- Equating resistance to key recovery with message security.
+- Reusing one key across encryption and MAC without a composition theorem.
+- Claiming deterministic public-key encryption is IND-CPA secure.
+- Reusing IVs or nonces in stream ciphers, CTR, or GCM.
+- Comparing MACs with early-exit code that leaks timing.
+- Ignoring a large reduction loss in a concrete-security claim.
+- Signing an ephemeral key without binding identities and transcript context.
+
+## Deep-Dive Entry
+
+> Dan Boneh and Victor Shoup, *A Graduate Course in Applied Cryptography*, v0.4, September 2017. Online: https://toc.cryptobook.us/
+>
+> Place `Applied Cryptography.pdf` under `math_book/` for targeted local full-text lookup.
+
+Useful chapters:
+
+- **§2:** attack-game framework.
+- **§3:** reductions and sequences of games.
+- **§4:** perfect, semantic, CPA, CCA, and authenticated-encryption notions.
+- **§5:** PRG/PRF/PRP and switching bounds.
+- **§6:** DL/CDH/DDH and random self-reducibility.
+- **§7:** symmetric constructions and composition.
+- **§11:** Sigma protocols and Fiat–Shamir.
+- **§12:** authenticated key exchange, forward secrecy, and PAKE.
+- **§13:** attack patterns and protocol failures.
+- **§16:** reusable reasoning patterns for reductions and games.

package/references/books/applied-cryptography.md

@@ -8,15 +8,15 @@
 
 **激活边界**：本书是**构造与证明优先**——讲攻击游戏、归约模板、序列游戏、具体安全界，**不是工程实现手册**。落地实现（侧信道、常数时间、协议状态机）需配实现密码学教材（如 Katz-Lindell 的工程章节）。这里给的是"安全定义怎么写、归约怎么构造、哪里会翻车"的**激活索引**。
 
-## 可迁移到 AI/安全分析的核心结构
+## 核心结构与跨域边界
 
 | 密码学结构（章节） | 迁移到 AI/ML/系统设计 |
 |---|---|
-| **攻击游戏框架（§2）** | 一切"对抗性建模"的模板：定义敌手能力→定义胜利→证不可赢；ML 鲁棒性、机制设计、对抗样本都可用 |
+| **攻击游戏框架（§2）** | 形式化敌手、接口与胜利事件；可启发 ML 威胁建模，但密码游戏名称和可忽略优势不能直接照搬 |
 | **归约证明模板（§3）** | "破我方案 ⇒ 解困难问题"的通用科学推理；安全性相对化、假设最小化 |
 | **序列游戏 + Difference Lemma（§3.4-3.5）** | 把复杂证明拆成可分析的小步；hybrid argument 的概率版 |
-| **CPA/CCA/AE 层级（§4）** | 能力递增的威胁模型，对应 ML 中"白盒/黑盒/自适应对抗"的层级化建模 |
-| **PRG/PRF/PRP 层级链（§5, §14）** | "弱假设→强原语"的构造链；AI 中类似"弱学习器→强学习器"的 boost 思路 |
+| **CPA/CCA/AE 层级（§4）** | 加密 oracle 能力的层级；不等同于 ML 中白盒/黑盒/梯度访问 |
+| **PRG/PRF/PRP 构造链（§5, §14）** | 密码原语间的构造与归约；与 boosting 只有高层类比，不能转移证明 |
 | **DDH/CDH/DL 假设族（§6）** | 离散对数族的严格强弱关系；假设最小化原则的实例 |
 | **Encrypt-then-MAC 合成（§7.9, §9.2）** | "合成不保安全"的典型反例；独立密钥、上下文绑定的工程铁律 |
 | **Sigma 协议 + Fiat-Shamir（§11）** | 三步承诺-挑战-响应；NIZK、Schnorr 签名的源头；可迁移到可验证计算 |
@@ -32,16 +32,16 @@
 
 ## 关键桥接事实（激活速记）
 
-- **Adv[A,S] := |Pr[W₀] − Pr[W₁]|，等价 bit-guessing：Adv\* = 2·Adv**（§2.2）：两实验优势 = 2×单实验猜中优势。
-- **PPT + 忽略函数 = "高效敌手 + 实际不可能"**（§2.3）：neg·poly = neg，poly·poly = poly，这是 hybrid 闭合性的基石。
+- **优势 convention 需先对齐**（§2.2）：双实验差、$|\Pr[b'=b]-1/2|$ 及其两倍都常见；倍数关系取决于定义。
+- **PPT + 忽略函数**（§2.3）：这是渐近安全语言；$\mathrm{poly}\cdot\mathrm{negl}=\mathrm{negl}$，但不自动代表固定参数下“实际不可能”。
 - **PRP Switching Lemma：Q 次查询区分 n-bit PRP 与随机函数优势 ≤ Q²/2^{n+1}**（§5.4）：AES 当 PRF 用只要查询数有界。
 - **Shannon 完美保密 ⇒ |K| ≥ |M|**（§4.1）：信息论安全的代价——密钥不得短于消息（OTP 的根源）。
-- **CPA 安全 ⇏ 多重加密安全（对称）；公钥 CPA ⇒ 多重安全**（§4.3）：公钥场景敌手本就能任意加密。
-- **EtM 安全；MtE/EaM 不安全**（§7.9）：合成顺序决定生死；padding oracle 攻 MtE。
-- **CCA ⇒ 不可延展；AE ⇒ CCA**（§4.4-4.5）：AE = CCA + 密文完整性，是 CCA 的标准路径。
+- **IND-CPA 已允许多次 encryption-oracle 查询**（§4.3）：单挑战与多挑战版本通常可经 hybrid 等价，但需满足相同随机性与消息限制，不能按“对称/公钥”一句话切开。
+- **EtM 有宽泛的通用合成定理**（§7.9）：MtE/EaM 的安全依赖具体编码、原语与错误泄露，不能无条件判不安全。
+- **AE 同时要求机密性与密文完整性**（§4.4-4.5）：常见定义可推出相应 CCA 机密性；精确蕴含取决于采用的游戏。
 - **DL 随机自归约**（§6.6）：DL 在随机实例上可解 ⇒ 任意实例可解，"全难或全易"。
 - **归约紧度 ε_RSA ≈ ε_sig / q_H**（§10.3）：ROM 归约常松，需参数补偿。
-- **量子威胁：Shor 破 RSA/DL；Grover 对称安全减半**（§14.3）：AES-128 量子下仅 64-bit。
+- **量子威胁**（§14.3）：Shor 破坏大整数分解/离散对数类方案；Grover 给理想黑盒穷举平方加速，但具体资源评估不能只用“安全位减半”。
 
 ## 适合激活的问题类型
 
@@ -50,31 +50,31 @@
 - **协议合成审查**：EtM/MtE/EaM 哪个能过？密钥是否独立？上下文（身份/转录）是否绑进 MAC？
 - **参数选择**：归约紧度 ε_scheme ≈ Q·ε_assumption，Q 多大？需多少额外 bit 补偿？量子下要多少？
 - **协议级失败诊断**：身份缺失、反射、降级、nonce 重用——根因在"上下文未绑定"还是"密钥复用"？
-- **迁移到 AI 鲁棒性**：把"攻击游戏"模板套到对抗样本、模型窃取、后门——敌手能力、胜利条件、归约目标是什么？
+- **AI×密码交叉**：仅迁移“明确敌手、接口、胜利条件”的定义纪律；若声称归约，还必须给安全参数、困难问题与可执行 reduction。
 
 ## 可能的算法启发
 
 > 密码学本身不直接产 GPU kernel，但其**设计思想**可迁移到 AI 安全/可验证计算：
 
 1. **对抗性建模迁移**：攻击游戏框架用于 ML 鲁棒性证明——定义敌手能力预算 → 定义"破" → 证不可破。*落点：方法论，不直接落 GPU。*
-2. **PRF 作为可验证伪随机**：用 PRF 生成训练数据划分/路由 seed，保证可复现且敌手不可预测。*落点：D1/D2——GEMM 友好。*
+2. **PRF 作为带密钥伪随机源**：可生成可复现 seed；不可预测性只在明确密钥泄露与查询模型下成立，且实现通常不是 GEMM。
 3. **Sigma 协议 → 可验证计算**：让 AI 推理产出 SNARK 式证明，验证者低成本核对。*落点：D3——验证端廉价、证明端昂贵。*
-4. **归约范式迁移到 ML 安全**：破模型鲁棒性 ⇒ 解某困难问题，给"相对安全"证书。*落点：方法论。*
-5. **承诺方案做水印**：用承诺方案做模型水印与可追踪分发。*落点：D1——哈希链廉价。*
+4. **归约范式用于交叉安全**：只有能构造正式 reduction 时才给“相对安全”结论；普通鲁棒性界不是密码学归约。
+5. **承诺用于工件绑定**：可绑定已承诺的模型摘要，但不自动给水印鲁棒性、所有权或可追踪性。
 
 ## GPU 友好性警告
 
-> 密码学结构与 GPU 八维（`../gpu-friendly-math.md`）的关系，与 AI 方向书稿相反——多数密码学原语**不在 GPU 友好维度**，而是 CPU/专用硬件域：
+> 纯密码任务不以 GPU 清单作为安全验收门。只有用户要求实现或性能分析时，才评估 `../gpu-friendly-math.md` 中相关的计算维度；多数原语使用 CPU、GPU 专用内核或其他硬件路径：
 
 **天然不友好但可专用硬件加速：**
-- **AES/SHA via SIMD/ASIC**：块密码/哈希走专用指令（AES-NI、SHA-NI），不走 GEMM。*违反 D1/D2。*
+- **AES/SHA via SIMD/ASIC**：AES-NI、SHA-NI 是 CPU 指令；GPU 有不同的批量 kernel。非 GEMM 不等于不可加速，D1/D2 对密码实现通常不适用。
 - **大数模乘/RSA**：bigint 运算，非张量化。*违反 D1/D2/D3。*
-- **椭圆曲线标量乘**：点加非 GEMM 化。*违反 D2。*
+- **椭圆曲线标量乘**：有限域算术与点运算通常非 GEMM；D2 对纯密码任务为 `N/A`。
 
 **方法论层面友好：**
 - **攻击游戏/归约模板**：纯逻辑推理，不涉及 GPU。
 - **PRF 作为 seed 生成**：一次性小开销，不构成瓶颈。
-- **可验证计算（SNARK）**：证明端重、验证端轻；验证可批量 GEMM 化。
+- **可验证计算（SNARK）**：证明/验证成本依证明系统而异，常见核心是有限域、椭圆曲线 MSM/配对或哈希，不应概括为 GEMM。
 
 **反模式警告：**
 - 把 AES/SHA 当 GEMM 算子去优化——南辕北辙。
@@ -90,7 +90,6 @@
 - **`algorithmic`（算法）**：归约即算法变换；复杂度可行性、并行性。
 - **`probabilistic`（概率统计）**：忽略函数、优势、birthday 攻击、hybrid argument。
 - **`duality`（对偶）**：信息论 vs 计算安全；模拟范式（敌手视角 ↔ 模拟器视角）。
-- **`causal`（因果）**：归约的"如果破 Y 则破 X"是因果链；相关≠因果在安全分析中至关重要。
 - **`categorical`（范畴化）**：原语间的蕴含关系形成偏序（OWF⇒PRG⇒PRF⇒...）。
 
 ## 反模式

package/references/books/differential-geometry.md

@@ -74,7 +74,7 @@
 
 ## GPU 友好性警告
 
-> 用 `../gpu-friendly-math.md` 的**八维记分卡**逐项评判。微分几何最大的坑是"度量 / 曲率矩阵的求逆与物化"。
+> 用 `../gpu-friendly-math.md` 评判相关实现维度，无关项标 `N/A`。微分几何实现常见风险是度量/曲率矩阵的求逆、物化与条件数。
 
 - **D2/D3**：求逆是生死线。 朴素自然梯度要算 N×N Fisher 的逆，N 是参数量（~10⁹），O(N³) 求逆 + O(N²) 显存，**直接出局**。
   - **可改造 [v]**：**K-FAC** 把 F 分块为 Kronecker 积 A⊗B，利用 (A⊗B)⁻¹ = A⁻¹⊗B⁻¹，只需对两个小因子求逆，且预条件作用到梯度上**就是 GEMM**。这就是"能否 Kronecker 因子化为 GEMM"的肯定答案——能，且这是它唯一可上集群的形态。