% ============================================================================
% part07b_security.tex — Part VII, security half (cybersecurity, applied cryptography incl. post-quantum
% standardisation, blockchain systems, privacy-preserving computation, federated learning, security of LLM systems).
% Written by Agent H (Security Specialist), WP44, 2026-11-03, from literature_synthesis/agent_H/review.md.
% Bibliography: references_part07b.bib (every key verified; references_verification_part07b.csv) plus keys of references.bib.
% Corpus quantities only through the \Sec... and \ItsSeriesCat... macros of tables/numbers.tex and the generated tables
% tab_security_counts, tab_security_summary, tab_security_llm_cooccurrence, tab_security_landmarks (tables/make_tables.py).
% The director merges this file with part07a_theory.tex into part07_theory_security.tex.
% ============================================================================

\section{Security, privacy and cryptography: scope and reading rules}
\label{sec:sec-scope}

The security half of this part reviews five categories of the ontology (Part~IV, Section~\ref{sec:m-classification}):
cybersecurity, applied cryptography, blockchain systems, privacy-preserving computation and its child category federated
learning. Together they form the \emph{security and privacy} area of the taxonomy. The five are related by subject matter
but not by size, growth or citation structure, and one purpose of this review is to show that the area is heterogeneous
enough that no single statement about ``security research after 2022'' is defensible. A second purpose is methodological:
the area's automatically selected landmark set is the one in which the limits of citation-based selection are most visible,
and the review documents those limits before it uses the set.

Three reading rules govern what follows. First, every quantitative statement comes from a result file of the corpus
through a generated macro or table; the macros of this part are listed in \texttt{tables/make\_numbers.py} under the Part~VII-b
block and the four tables under \texttt{tables\_part07b} of \texttt{tables/make\_tables.py}. Second, the works discussed are known
through their bibliographic metadata and, for \SecLandWithAbstractPct\,\% of the landmark set, through their abstracts; no full
text was read for this review, and wording such as ``the abstract reports'' marks the boundary. Third, works that are
preprints are called preprints: several of the most important papers on the security of language-model systems have no
peer-reviewed version in the corpus, and the review treats them as the field does, as influential but unreviewed.

\subsection{Volume}
\label{sec:sec-volume}

Table~\ref{tab:security_counts} gives, for each category and publication year, the number of eligible works that carry the
category (multi-label) and the number for which it is the primary category. Cybersecurity is the largest category of the
area by a wide margin: \SecCountCybersecurityTwoZeroTwoTwoMultilabel{} works carried the label in 2022 and
\SecCountCybersecurityTwoZeroTwoFiveMultilabel{} in 2025, \SecCountCybersecurityAllMultilabel{} over 2018--2026, and its share
of primary classifications in the corpus moved from \SecSharePrimaryCybersecurityTwoZeroOneEightPct\,\% in 2018 to
\SecSharePrimaryCybersecurityTwoZeroTwoFivePct\,\% in 2025. Applied cryptography is the second category; blockchain and
privacy-preserving computation are of similar size in 2018 and diverge afterwards; federated learning, which barely existed
as a labelled literature in 2018 (\SecCountFederatedLearningTwoZeroOneEightMultilabel{} works), reached
\SecCountFederatedLearningTwoZeroTwoFiveMultilabel{} works in 2025.

The growth profiles are the first evidence of heterogeneity (Table~\ref{tab:security_summary}, which also restates the
category rows of Table~\ref{tab:breaks}). Over the baseline years 2018--2022 the two security categories were nearly flat:
compound annual growth of the multi-label count was \SecCagrMultilabelCybersecurityBaselinePct\,\% for cybersecurity and
\SecCagrMultilabelAppliedCryptographyBaselinePct\,\% for applied cryptography. Over 2023--2025 both grew faster
(\SecCagrMultilabelCybersecurityPostPct\,\% and \SecCagrMultilabelAppliedCryptographyPostPct\,\%). Privacy-preserving
computation grew throughout (\SecCagrMultilabelPrivacyPreservingComputationBaselinePct\,\% then
\SecCagrMultilabelPrivacyPreservingComputationPostPct\,\%). Federated learning had the steepest baseline growth of the area
(\SecCagrMultilabelFederatedLearningBaselinePct\,\%) and remained the fastest-growing category after 2023
(\SecCagrMultilabelFederatedLearningPostPct\,\%), but its growth rate fell. Blockchain is the exception to the post-2023
acceleration: its growth was front-loaded (\SecCagrMultilabelBlockchainBaselinePct\,\% then
\SecCagrMultilabelBlockchainPostPct\,\%), and its share of primary classifications peaked around 2020
(\SecSharePrimaryBlockchainTwoZeroTwoZeroPct\,\%) before settling at \SecSharePrimaryBlockchainTwoZeroTwoFivePct\,\% in 2025 on a
larger corpus. The 2026 row of every table is incomplete, for the indexing reasons documented in Part~III
(Section~\ref{sec:data-dates}), and no growth rate in this part uses it.

Primary-category counts are systematically lower than multi-label counts, by a factor that itself carries information: for
cybersecurity the primary count is less than half the multi-label count, because the category co-occurs with computer
networks, computer vision (detection models) and applied cryptography; for federated learning the ratio is lower still,
because the category is a child of privacy-preserving computation and most of its works also carry machine-learning
labels. Growth rates computed on primary counts (the convention of Table~\ref{tab:cagr}) and on multi-label counts
therefore differ: on primary counts cybersecurity grew at \SecCagrPrimaryCybersecurityBaselinePct\,\% over 2018--2022 and
\SecCagrPrimaryCybersecurityPostPct\,\% over 2023--2025. The qualitative pattern is the same under both conventions, and the
multi-label series is used below because the structural-change estimates of Part~IV are computed on it.

\subsection{Structural change}
\label{sec:sec-breaks}

The interrupted-time-series estimates at the 2022-12 reference month (Part~IV, Section~\ref{sec:m-its}) are reported in
Table~\ref{tab:security_summary}. Writing the log monthly count as $y_t = \alpha + \beta t + \gamma D_t + \delta (t - t_0) D_t +
\varepsilon_t$ with $D_t$ the post-event indicator, the level coefficient $\gamma$ is not distinguishable from zero for
cybersecurity (\ItsSeriesCatCybersecurityItsChatgptLevelChange, $p = \ItsSeriesCatCybersecurityItsChatgptLevelP$), applied
cryptography (\ItsSeriesCatAppliedCryptographyItsChatgptLevelChange, $p = \ItsSeriesCatAppliedCryptographyItsChatgptLevelP$),
blockchain (\ItsSeriesCatBlockchainItsChatgptLevelChange, $p = \ItsSeriesCatBlockchainItsChatgptLevelP$) or privacy-preserving
computation (\ItsSeriesCatPrivacyPreservingComputationItsChatgptLevelChange,
$p = \ItsSeriesCatPrivacyPreservingComputationItsChatgptLevelP$). Federated learning is the exception, with a negative level
coefficient (\ItsSeriesCatFederatedLearningItsChatgptLevelChange, $p = \ItsSeriesCatFederatedLearningItsChatgptLevelP$) and a
negative slope change (\ItsSeriesCatFederatedLearningItsChatgptSlopeChange, $p = \ItsSeriesCatFederatedLearningItsChatgptSlopeP$)
against a steep pre-period slope of \ItsSeriesCatFederatedLearningItsChatgptPreSlope{} per month: the category decelerated. The
slope coefficient $\delta$ is positive and precisely estimated for cybersecurity
(\ItsSeriesCatCybersecurityItsChatgptSlopeChange{} per month, against a pre-period slope of
\ItsSeriesCatCybersecurityItsChatgptPreSlope), applied cryptography (\ItsSeriesCatAppliedCryptographyItsChatgptSlopeChange) and
privacy-preserving computation (\ItsSeriesCatPrivacyPreservingComputationItsChatgptSlopeChange), and null for blockchain
(\ItsSeriesCatBlockchainItsChatgptSlopeChange, $p = \ItsSeriesCatBlockchainItsChatgptSlopeP$). A slope change $\delta$ on the log
series compounds to a factor $e^{12\delta}$ per year relative to the pre-period trend, so these are not small effects; what
they are not is evidence that the change occurred in December 2022.

The placebo distribution over \ItsSeriesCatCybersecurityPlaceboChatgptNPlacebo{} alternative event months
(Section~\ref{sec:m-placebo}) is the first qualification. The slope $t$-statistic at the reference month ranks
\ItsSeriesCatAppliedCryptographyPlaceboChatgptSlopeTRank{}th of the placebo set for applied cryptography (placebo
$p = \ItsSeriesCatAppliedCryptographyPlaceboChatgptSlopeTPlaceboP$), \ItsSeriesCatCybersecurityPlaceboChatgptSlopeTRank{}th for
cybersecurity ($p = \ItsSeriesCatCybersecurityPlaceboChatgptSlopeTPlaceboP$) and
\ItsSeriesCatPrivacyPreservingComputationPlaceboChatgptSlopeTRank{}th for privacy-preserving computation
($p = \ItsSeriesCatPrivacyPreservingComputationPlaceboChatgptSlopeTPlaceboP$); for blockchain and federated learning the
reference month is unremarkable (slope placebo $p = \ItsSeriesCatBlockchainPlaceboChatgptSlopeTPlaceboP$ and
\ItsSeriesCatFederatedLearningPlaceboChatgptSlopeTPlaceboP), and the federated-learning level drop is likewise unremarkable
(level placebo $p = \ItsSeriesCatFederatedLearningPlaceboChatgptLevelTPlaceboP$). The break detectors are the second
qualification. Bai--Perron with BIC selection (Section~\ref{sec:m-bp}) dates a single break at
\SecBreakCybersecurityBpBreaksBic{} for cybersecurity, at \SecBreakAppliedCryptographyBpBreaksBic{} for applied cryptography and
at \SecBreakPrivacyPreservingComputationBpBreaksBic{} for privacy-preserving computation---five months before the reference
event---and at \SecBreakBlockchainBpBreaksBic{} and \SecBreakFederatedLearningBpBreaksBic{} for blockchain and federated
learning, which are breaks of the pandemic period, not of the window. PELT places change points at
\SecBreakCybersecurityPelt{} for cybersecurity and \SecBreakAppliedCryptographyPelt{} for applied cryptography, at
\SecBreakPrivacyPreservingComputationPelt{} for privacy-preserving computation and at \SecBreakFederatedLearningPelt{} for
federated learning. The donut specification, which drops three months on either side of the reference date, turns the level
coefficients of cybersecurity (\ItsSeriesCatCybersecurityItsChatgptDonutLevelChange,
$p = \ItsSeriesCatCybersecurityItsChatgptDonutLevelP$) and applied cryptography
(\ItsSeriesCatAppliedCryptographyItsChatgptDonutLevelChange, $p = \ItsSeriesCatAppliedCryptographyItsChatgptDonutLevelP$)
positive while leaving the slopes unchanged, which says that the months around the reference date are themselves unusual.
Among the alternative event dates (Section~\ref{sec:m-altdates}) the one that carries a large positive level coefficient
for all three accelerating categories is the latest, 2024-10 (cybersecurity \SecBreakCybersecurityOOneLevel,
$p = \SecBreakCybersecurityOOneLevelP$; applied cryptography \SecBreakAppliedCryptographyOOneLevel; privacy-preserving computation
\SecBreakPrivacyPreservingComputationOOneLevel), consistent with the late-2024 change points of PELT.

The reading these estimates support is deliberately modest. The two security categories and privacy-preserving computation
grew faster after 2023 than before; the acceleration is dated by the detectors to mid-2022 and to late 2024 rather than to
a single month; and part of it is compositional, in the sense developed in Section~\ref{sec:sec-cyber-llm}, where the share
of these categories' works co-classified with the LLM category is shown to have risen several-fold. Blockchain and federated
learning are stories of the baseline period: both broke upward in early 2020 and neither accelerated after 2022. None of
this is causal evidence about any product release; the reference month is a convention of the design (Part~IV), and the
present part uses it only as a date.

\subsection{The landmark sample and its limits}
\label{sec:sec-landmarks}

The landmark set of the area (Table~\ref{tab:security_landmarks}) contains \SecLandN{} works, twenty-five per category,
selected automatically as the works with the highest field-normalised 36-month citation score within each primary category
\citep{waltman2019fieldnormalization,wang2013citationwindow}, with 2025--2026 works ranked by 12-month citations relative to
their cohort (Part~IV, Section~\ref{sec:m-citations}). Three properties of this selection shape the review. The metric is
blind to record quality: a duplicated, misdated or misclassified record ranks as high as a genuine landmark when the
database attaches citations to it, and the area contains conspicuous cases---the Bitcoin whitepaper
\citep{nakamoto2008bitcoin} appears as three distinct SSRN records dated 2019, 2022 and 2024, TLS~1.3 appears twice, a 2010
election case study and a 2010 number-theory library appear as 2026 repository records, a venue (``IEEE Symposium on Security
and Privacy'') appears as a 2023 work, and a time-series forecasting architecture is filed under cybersecurity. The metric
favours surveys and application papers in categories whose citing community is broad (blockchain, federated learning) and
favours standards and reports where the influential documents are not articles (applied cryptography):
\SecLandTypeReport{} of the \SecLandN{} records are reports, \SecLandTypeBookChapter{} are book chapters and
\SecLandTypeDissertation{} are dissertations, against \SecLandTypeArticle{} journal articles. And \SecLandYearTwoZeroTwoSix{}
records are dated 2026 and ranked on a few months of citations; their normalised scores measure position in a cohort, not
durable influence. \SecLandNoDoi{} records have no DOI.

The review therefore treats the landmark list as a sample of what is highly cited under the corpus's own metric,
documents its artefacts category by category, and supplements it with the verified references of the main bibliography where
the automatic selection missed works that a specialist would consider foundational---the hash-based signature standard,
the prompt-injection and jailbreak papers, differentially private stochastic gradient descent, secure aggregation. The
contributions table of the area (\texttt{literature\_synthesis/agent\_H/contributions.csv}) records, for each landmark, whether
its contribution type was judged from the abstract or from metadata alone; \SecLandWithAbstractPct\,\% of the records have an
abstract. The principal-investigator review of the landmark set (protocol checkpoint H-3) should act on the artefacts
listed here before any landmark-level statistic is reported in Part~IX.

\section{Cybersecurity}
\label{sec:sec-cyber}

\subsection{The baseline literature as the citation metric sees it}
\label{sec:sec-cyber-baseline}

The pre-window cybersecurity landmarks are not the works a security researcher would name first. The microarchitectural
attacks of 2018, Spectre and Meltdown \citep{kocher2019spectre,lipp2018meltdown}, are in the verified bibliography but not in
the category's top twenty-five: they are classified under computer architecture by the ontology, and their citations
accrue in venues the cybersecurity mapping weights partially. What the metric selects instead is, first, machine-learning
detection on shared datasets---the CIC-IDS2017 intrusion-detection dataset paper, which has no abstract in the record and
which is, by its 36-month citation count, the single most reused benchmark of the network-intrusion literature---and,
second, surveys that present distributed ledgers as a security solution: the IEEE Access review of blockchain for the
Internet of Things \citep{fernandez2018biot}, the IEEE Communications Surveys and Tutorials survey of the security and privacy
of Bitcoin \citep{conti2018bitcoinsecurity}, and a healthcare-cloud position paper \citep{esposito2018healthcare}. The
third baseline landmark is the chapter version of \citet{kurakin2018physical}, a 2018 reprint of the 2017 workshop paper on
adversarial examples in the physical world; its abstract reports that adversarial perturbations survive printing and camera
capture, so that the threat demonstrated in the digital setting by \citet{szegedy2014intriguing} and
\citet{goodfellow2015fgsm} transfers to deployed sensors. This is the only baseline landmark of the category that belongs to
the security of machine learning, and it matters because the post-2022 literature of the category is largely an extension
of that line.

Ten of the twenty-five cybersecurity landmarks are grey literature (dissertations, book chapters, a report), five have no
DOI and nine are dated 2026; the composition is the most irregular of the five categories. The record with the highest
normalised score in the whole area is a 2026 SSRN preprint on persistent homology as a prompt-injection defence, without
abstract, that accumulated its citations within months; it cannot be assessed from metadata, it is not peer-reviewed, and it
is flagged for the principal-investigator review rather than discussed.

\subsection{The security of language-model systems}
\label{sec:sec-cyber-llm}

The post-2023 cybersecurity landmarks with abstracts cluster in two groups: language models used \emph{for} security
tasks and the security \emph{of} language-model systems. In the first group, the ACM Transactions on Software Engineering
and Methodology paper on Vul-RAG \citep{du2026vulrag} is the most informative, because its abstract reports a negative
result before its positive one: large language models distinguish vulnerable code from similar-but-benign patched code with
an accuracy of 0.06--0.14, and knowledge-level retrieval augmentation---retrieving abstracted vulnerability knowledge from
historical fixes---raises that accuracy by 16--24 points. HuntGPT \citep{ali2026huntgpt} couples a conventional anomaly
detector with explainability tools and a language-model interface, and its abstract frames the contribution as
acceptance by incident responders rather than detection accuracy; a fine-tuned RoBERTa phishing-email detector
\citep{uddin2026phishing} reports gains on specific datasets. On the offensive side, the verified bibliography records two
preprints that the landmark metric does not reach: PentestGPT \citep{deng2023pentestgpt} and the study reporting that
language-model agents can autonomously exploit one-day vulnerabilities \citep{fang2024oneday}. Neither has a peer-reviewed
version in the corpus.

In the second group, the ACM Computing Surveys survey of security and privacy challenges of large language models
\citep{das2025llmsecurity} organises the attack surface---jailbreaking, data poisoning, leakage of personally identifiable
information---and the ACM TOSEM study of the Model Context Protocol \citep{hou2026mcp} is the first landmark to treat the
tool-use layer of agent systems as an object of security analysis: its abstract describes a lifecycle of MCP servers in four
phases and sixteen activities and a taxonomy of threats attached to each. The foundational attack papers are, again, outside
the landmark set and inside the verified bibliography: the ``ignore previous prompt'' attack \citep{perez2022ignore},
indirect prompt injection through retrieved content \citep{greshake2023injection}, prompt injection against integrated
applications \citep[preprint]{liu2023promptinjection}, the analysis of why safety training fails
\citep[preprint]{wei2023jailbroken}, universal and transferable adversarial suffixes \citep[preprint]{zou2023universal}, and
the surveys of \citet{yao2024llmsecurity} and \citet[preprint]{shayegani2023adversarial}. The pre-window lineage of these
works is the privacy and robustness literature of the previous decade: membership inference \citep{shokri2017membership},
extraction of training data from language models \citep[preprint]{carlini2021extracting}, and the demonstration that
poisoning web-scale training sets is practical \citep{carlini2024poisoning}.

The corpus statistics locate this turn (Table~\ref{tab:security_llm_cooccurrence}). Works co-classified as cybersecurity and
LLM represented \SecCoocCybersecurityLlmTwoZeroTwoTwoPct\,\% of cybersecurity works in 2022,
\SecCoocCybersecurityLlmTwoZeroTwoFivePct\,\% in 2025 and \SecCoocCybersecurityLlmTwoZeroTwoSixPct\,\% in the incomplete 2026;
co-classification with AI agents reached \SecCoocCybersecurityAiAgentsTwoZeroTwoSixPct\,\% in 2026, and with AI safety
\SecCoocCybersecurityAiSafetyTwoZeroTwoFivePct\,\% in 2025. The non-zero shares before 2022 are a property of the keyword rules
of the AI categories, which match pre-transformer language-model work, so the table should be read for its trend. Citation
flows record the same movement more weakly: \SecFlowCybersecurityToLlmTwoZeroTwoFivePct\,\% of the resolved references of
cybersecurity works in 2025 went to works of the LLM category (\SecFlowCybersecurityToLlmTwoZeroTwoSixPct\,\% in 2026), against
\SecFlowCybersecurityToCybersecurityTwoZeroTwoFivePct\,\% to cybersecurity itself; the inverse flow, from LLM works to
cybersecurity works, was \SecFlowLlmToCybersecurityTwoZeroTwoFivePct\,\% in 2025. The security literature is, by this measure,
labelling its objects faster than it is citing the literature that produced them.

\subsection{Assessment}
\label{sec:sec-cyber-assessment}

Three statements are established on the evidence available. The security-of-machine-learning literature predates the window,
and the post-2022 literature on language-model systems extends it to a new attack surface in which instructions arrive as
data, through retrieved documents, tool outputs and agent protocols. The highly cited post-2022 works of the category are,
in the main, surveys and systems papers rather than attacks; the attacks are preprints. And the category's growth after
2023 is partly a change of composition, visible in co-classification before it is visible in citation flows. One statement
is contested within the landmark abstracts themselves: whether language-model-based detection improves on fine-tuned
encoders or on classical features at equal cost, since the Vul-RAG abstract reports a very low base accuracy and the
phishing and HuntGPT abstracts report gains on particular datasets. One statement is speculative: that defences against
prompt injection can be made robust rather than patched; no landmark reports a defence with a guarantee, and the only
landmark on the question argues the negative and is unreviewed. Whether the language-model-security literature is a durable
subfield or a labelling wave is a question the corpus cannot answer yet, because the first 36-month citation windows of its
2023--2024 cohort close in 2026--2027 (open problem P-H-03).

\section{Applied cryptography and the post-quantum transition}
\label{sec:sec-crypto}

\subsection{Standards as landmarks}
\label{sec:sec-crypto-standards}

Applied cryptography is the clearest case in the corpus of a category whose most cited documents are standards and reports
rather than papers. Five of its twenty-five landmarks are of that kind: RFC~8446, the specification of TLS~1.3
\citep{rescorla2018tls13}, whose abstract states the protocol's purpose as preventing ``eavesdropping, tampering, and message
forgery''; the status reports on the first and third rounds of the NIST post-quantum cryptography standardisation process
\citep{nist2019pqcround1,nist2022pqcround3}; and the two 2024 Federal Information Processing Standards FIPS~203 and FIPS~204
\citep{nist2024fips203,nist2024fips204}. The abstract of FIPS~203 relates the security of its key-encapsulation mechanism, ML-KEM,
to the computational difficulty of the module learning-with-errors problem and states that the scheme ``is believed to be
secure, even against adversaries who possess a quantum computer''; FIPS~204 makes the same statement for the ML-DSA signature
scheme. The hash-based signature standard FIPS~205 \citep{nist2024fips205} is not in the landmark set but completes the 2024
publication; the draft transition report \citep{nist2024transition} and the fourth-round status report \citep{nist2025hqc}
complete the sequence, and the latter is cited here for its date and existence only, since its content was not read.

That the lattice standards rest on \citet{regev2009lwe} and respond to the threat model set by \citet{shor1997factoring} is
part of the pre-window lineage that Part~II records; the rationale for the programme is the one \citet{bernstein2017pqc}
set out before the window opened. The window's principal quantum-side event, the demonstration of error correction below
threshold \citep{googlequantum2025belowthreshold}, is classified under quantum computing and is discussed there. What the
corpus adds is a measurement of how little the standardisation timeline moved the category's aggregate volume: the
Bai--Perron break of applied cryptography (\SecBreakAppliedCryptographyBpBreaksBic) coincides with the month of the
third-round announcement, but the category's post-2023 growth is carried by sub-literatures that have nothing to do with
lattices (Section~\ref{sec:sec-crypto-rest}), and the share of the category's references that go to works of the
quantum-computing category rose only from \SecFlowAppliedCryptographyToQuantumComputingTwoZeroOneNinePct\,\% in 2019 to
\SecFlowAppliedCryptographyToQuantumComputingTwoZeroTwoFivePct\,\% in 2025.

\subsection{The lesson of the broken candidates}
\label{sec:sec-crypto-breaks}

The one landmark of the category that is an attack is the key-recovery attack on SIDH of \citet{castryck2023sidh}, published
at EUROCRYPT 2023 after circulating in 2022; the corpus record has no abstract and the work is known here by its title,
which records a key recovery against the isogeny-based scheme on which the SIKE candidate was built. The verified bibliography
adds \citet{beullens2022rainbow}, whose title records that breaking the multivariate signature candidate Rainbow ``takes a
weekend on a laptop''. Both attacks are classical. The methodological lesson is the one the review draws for the whole area:
``post-quantum'' names a threat model, not a security proof, and two of the schemes that had survived three rounds of
public scrutiny fell to attacks whose cost was measured in days. The standards' own wording---``believed to be secure''---is
the correct one, and the open problem for the category (P-H-04) is the rate at which the standardised lattice schemes attract
cryptanalysis, which the corpus can measure in later snapshots by following citations to FIPS~203 and FIPS~204.

A second, unmeasured problem is deployment. The corpus records standards and reports; it does not record whether TLS
handshakes negotiate post-quantum key exchange, and the transition timeline of \citet{nist2024transition} is one the
literature has not yet evaluated. Internet-measurement studies of that kind belong to computer networks and are listed
among the open problems (P-H-05) rather than reviewed here.

\subsection{The rest of the category}
\label{sec:sec-crypto-rest}

The remaining landmarks of applied cryptography are instructive about the category's composition. Three of its 2025--2026
landmarks are chaos-based or neuron-model image and video encryption schemes, published in IEEE Transactions on Dependable
and Secure Computing, IEEE Transactions on Consumer Electronics and Nonlinear Dynamics, and one is a cryptanalysis of a
scheme of that kind in ACM Transactions on Multimedia Computing, whose abstract reports that ``many such systems lack
standardization and deviate from secure design principles''. The sub-literature is large: the ontology maps the OpenAlex
topic for chaos-based image and signal encryption to the category at reduced weight (Part~IV), and its presence among the
most cited 2026 works is a fact about the citing community rather than an endorsement; the category's own cryptanalyses
contest it, and the review records the dispute as unresolved within the corpus (P-H-06).

Several other records are artefacts of the kind catalogued in Section~\ref{sec:sec-landmarks}: a 2022 ACM reprint of Diffie
and Hellman's 1976 \emph{New Directions in Cryptography}, whose ``abstract'' in the record is the publisher's landing page; a
2026 record of TLS~1.3 whose text describes an earlier protocol version; the 2026 repository copies of the 2010 Scantegrity~II
election case study and of the FLINT number-theory library; and a Reed--Solomon decoder dissertation. The 2020 reprint of
\emph{Deep Leakage from Gradients} \citep{zhu2020dlg}, filed here, is a gradient-inversion attack on federated updates and is
discussed with federated learning (Section~\ref{sec:sec-fl-privacy}); a 2026 Information Fusion survey of attacks and
defences in federated learning \citep{jimenezgutierrez2026flsecurity}, whose abstract reports coverage of 203 papers, is filed
here because of its cryptographic vocabulary.

Conspicuously absent from the top twenty-five are homomorphic encryption, zero-knowledge proofs and secure multi-party
computation as primitives. Their lineage is in the verified bibliography---\citet{gentry2009fhe}, the BGV and CKKS schemes
\citep{brakerski2014bgv,cheon2017ckks}, TFHE \citep{chillotti2020tfhe}, the surveys of \citet{acar2018hesurvey} and
\citet{marcolla2022fhesurvey}, succinct arguments \citep{groth2016snark,thaler2022proofs} and the pragmatic introduction to
multi-party computation of \citet{evans2018mpc}---and their post-2022 progeny exist in the corpus; they do not surface because
their citing communities are small and their venues (the IACR ePrint archive, TCHES) are only partially mapped to the
category. The absence is a statement about the metric, not about the literature (claim C-H-36 of the claims table), and it is
one reason the review does not use the landmark set to rank sub-areas.

\section{Blockchain systems}
\label{sec:sec-blockchain}

\subsection{A literature that moved out of computer science}
\label{sec:sec-blockchain-shape}

Blockchain is the category whose landmark set is least about computer science. Two of its twenty-five works are in the
\emph{Review of Financial Studies}: the estimate of \citet{foley2019bitcoin} that about a quarter of bitcoin users are involved
in illegal activity, and the theory of decentralised consensus, competition and smart contracts of \citet{cong2019smartcontracts}.
One is in the \emph{Journal of Institutional Economics}, where \citet{davidson2018institutions} argue that blockchains are an
``institutional technology'' rather than merely a general-purpose one. Supply-chain management \citep{saberi2019supplychain},
agri-food supply chains, business process management with its seven research directions \citep{mendling2018bpm},
ontology-driven provenance \citep{kim2018provenance}, and chapters from MIT Press and Springer complete the picture of a
literature whose highly cited works are read in management, economics and information-systems venues. The ontology
anticipated this: the category's OpenAlex topic is large and the mapping notes that the keyword ``blockchain'' is
unambiguous, so the classification is not at fault; the citing community is simply not the one the taxonomy was built for.

The computer-science core among the landmarks is thin but clear. Hyperledger Fabric \citep{androulaki2018fabric}, ``a modular
and extensible open-source system for deploying and operating permissioned blockchains'', is the category's system paper; the
IEEE Access survey of consensus mechanisms and mining-strategy management \citep{wang2019consensus} and the NIST overview
\citep{yaga2018blockchain} are its reference surveys; \citet{guo2022blockchainsecurity} survey the security of the technology
itself, with a quantitative comparison of consensus algorithms and a risk analysis, per the abstract. The one technical
landmark dated 2026 is a Datalog-based detector of cross-function reentrancy over Ethereum Virtual Machine execution traces
\citep{guesmi2026reentrancy}, which its abstract describes as an extension of the TxSpector framework with new rules and a
modernised trace extractor. The post-window landmarks are otherwise reviews: blockchain for the metaverse
\citep{huynh2023metaverse}, with the highest 36-month count of any post-2022 work in the category; blockchain in healthcare;
the NFT overview preprint of \citet{wang2021nft}; and two 2024 papers in a single journal with identical citation counts that
the principal-investigator review should examine. The decentralised-finance literature that the verified bibliography
records through \citet{werner2022defi}, and the consensus theory on which permissioned ledgers rest
\citep{castro2002pbft}, do not reach the top twenty-five of a category whose citing community is dominated by application
journals.

\subsection{Artefacts and statistics}
\label{sec:sec-blockchain-stats}

The Bitcoin whitepaper appears three times, as SSRN records dated 2019, 2022 and 2024, and a fourth time as a Springer
``recommends'' chapter; the 2022 record is the single most cited work of the whole area by 36-month citations, and all of
these counts belong to the 2008 document \citep{nakamoto2008bitcoin}. A 2026 SSRN record titled ``Global Blockchain
Benchmarking Study'', without abstract, is in all likelihood a reissue of an earlier industry report. These duplicates are the
area's largest single distortion of landmark-level statistics (open problem P-H-14).

The corpus statistics are those of a literature whose expansion ended before the window. The category's Bai--Perron break is
dated \SecBreakBlockchainBpBreaksBic{}, its PELT change points are \SecBreakBlockchainPelt{}, and the interrupted time series
at 2022-12 shows neither a level nor a slope change against a pre-period slope (\ItsSeriesCatBlockchainItsChatgptPreSlope{} per
month) that was the steepest of the five categories after federated learning. The self-citation share of blockchain works
fell from \SecFlowBlockchainToBlockchainTwoZeroOneNinePct\,\% in 2019 to \SecFlowBlockchainToBlockchainTwoZeroTwoFivePct\,\% in
2025, with the share of references to cybersecurity rising; co-classification with the LLM category is the lowest of the area
(\SecCoocBlockchainLlmTwoZeroTwoFivePct\,\% in 2025). Established, then: the category grew fastest before 2021 and has grown at
roughly the corpus's pace since, and its highly cited post-2022 works are reviews. Contested: whether smart-contract security
tooling has reduced measured exploit rates since 2020, a question on which the single 2026 landmark, an extension of an
existing detector, offers no evidence (P-H-07). Speculative: every claim about the integration of blockchains with the
metaverse or with artificial intelligence in the 2023--2026 reviews, none of which reports a deployed system.

\section{Privacy-preserving computation}
\label{sec:sec-privacy}

\subsection{Composition of the landmark set}
\label{sec:sec-privacy-composition}

The landmarks of privacy-preserving computation fall into four groups, and the fourth is a classification failure that the
review must report before it can use the other three. The first group is federated learning considered as a privacy
technology, which the ontology makes a child of this category: \citet{yang2019fml}, whose ACM Transactions on Intelligent
Systems and Technology paper introduced the vocabulary of horizontal, vertical and transfer federated learning and is, by
36-month citations, the most cited technical paper of the whole area; SplitFed \citep{thapa2022splitfed}, which combines split
learning and federated learning so that clients hold only part of the model; the 2026 ACM Computing Surveys systematic review
of differentially private federated learning \citep{fu2026dpfl}, whose abstract calls differential privacy ``the de facto
standard for privacy protection in federated learning''; and several federated healthcare applications. The second group is
the 2020 contact-tracing burst: a survey of COVID-19 contact-tracing applications \citep{ahmed2020tracingapps}, the privacy
analysis of TraceTogether \citep[preprint]{cho2020tracing}, a cross-country acceptability survey, a \emph{Nature Medicine}
comment on the responsible use of digital data, an OECD policy note and a German-language chapter on the Corona-Warn-App:
six of twenty-five landmarks from a single year's topic, which the ontology maps to the category at half weight. The third
group is the privacy of models and data: the survey of machine unlearning \citep{nguyen2025unlearning}, framed by the
``right to be forgotten'' and by the observation that deleting data from back-end stores is not sufficient when models
remember; the scoping review of differential privacy in medical deep learning \citep{mohammadi2026dpmedical}; a dissertation
on private information retrieval with side information; and a 2018 paper on privacy-aware mobile service recommendation.

The fourth group consists of three 2025--2026 papers on artificial intelligence in higher education and one on artificial
intelligence in auditing, published in \emph{Education Sciences}, \emph{Frontiers in Psychology}, \emph{Frontiers in Education}
and the \emph{International Journal of Accounting Information Systems}, each ranked near the top of the category by normalised
citations. Their abstracts mention privacy as one concern among several; the keyword rule of the category fired on the word
in a context that its exclusion list does not veto. Two further records---open-circuit fault diagnosis of power converters
and a federated model for predicting student mental-health risk---are applications whose privacy content is the federated
setting. The principal-investigator review should reclassify the four education and auditing papers; the review does not use
them.

\subsection{Lineage and evidence}
\label{sec:sec-privacy-lineage}

The vocabulary that the post-2022 landmarks apply was fixed before the window: differential privacy
\citep{dwork2006dp,dwork2014dp}, its application to stochastic gradient descent \citep{abadi2016dpsgd}, membership inference
\citep{shokri2017membership}, extraction of training data from language models \citep[preprint]{carlini2021extracting} and
web-scale poisoning \citep{carlini2024poisoning}. Among the landmarks only the two 2026 reviews synthesise this vocabulary
with evidence. The medical review \citep{mohammadi2026dpmedical} is the more specific: its abstract reports, over 74 eligible
studies, that differentially private training can maintain clinically acceptable performance under moderate budgets
($\varepsilon \approx 10$), particularly in imaging, while strict budgets ($\varepsilon \approx 1$) often cost substantial accuracy.
That is the review's own summary and is cited as such; it is also the clearest statement in the landmark set of the
utility--privacy trade-off that the category's applied literature tends to assert away (open problem P-H-10).

The category is the one whose boundary with machine learning moved most during the window. Its self-citation share fell from
\SecFlowPrivacyPreservingComputationToPrivacyPreservingComputationTwoZeroOneNinePct\,\% in 2019 to
\SecFlowPrivacyPreservingComputationToPrivacyPreservingComputationTwoZeroTwoFivePct\,\% in 2025, the lowest of the area,
while references to federated learning rose to \SecFlowPrivacyPreservingComputationToFederatedLearningTwoZeroTwoFivePct\,\%
and references to LLM works reached \SecFlowPrivacyPreservingComputationToLlmTwoZeroTwoSixPct\,\% in 2026. Its works are
co-classified with the LLM category at \SecCoocPrivacyPreservingComputationLlmTwoZeroTwoFivePct\,\% in 2025, the highest rate
of the area, up from \SecCoocPrivacyPreservingComputationLlmTwoZeroTwoTwoPct\,\% in 2022. The category grew throughout the
observation period; its Bai--Perron break is dated \SecBreakPrivacyPreservingComputationBpBreaksBic{} and its PELT change
points \SecBreakPrivacyPreservingComputationPelt{}, the first of which is the contact-tracing year. Established, on this
evidence: differential privacy and federated learning are the two privacy technologies that the applied literature adopts,
and the accuracy cost of strict budgets is documented. Contested: the privacy guarantees of federated learning deployed
without differential privacy or secure aggregation, to which the next section returns. Speculative: the ``privacy by design''
claims of federated healthcare applications that report no attack evaluation.

\section{Federated learning}
\label{sec:sec-fl}

\subsection{From averaging to heterogeneity}
\label{sec:sec-fl-heterogeneity}

The federated-learning landmarks read as the field's own history, and the review follows that order. The pre-window
foundations are in the verified bibliography: federated averaging \citep{mcmahan2017fl}, the collective survey of advances and
open problems \citep{kairouz2021fl}, and the proximal regularisation of FedProx \citep[preprint]{li2018fedprox}. The baseline
landmarks are applications and surveys built on them: federated learning in medicine \citep{sheller2020flmedicine}, whose
abstract presents multi-institutional model training ``without sharing data between institutions'' as the answer to
privacy and ownership obstacles; FedHealth \citep{chen2020fedhealth}, a federated transfer-learning framework for wearables;
the healthcare-informatics review of \citet{xu2021flhealth}; the fairness objective $q$-FFL \citep[preprint]{li2019qffl},
which reweights the aggregate loss toward a more uniform accuracy distribution across devices (the corpus record of the
conference version has no DOI); the survey of \citet{zhang2021flsurvey}, the non-IID survey of \citet{zhu2021noniid}, and
\citet{tan2023personalizedfl}, whose IEEE Transactions on Neural Networks and Learning Systems survey calls federated learning
``the leading paradigm for the training of machine learning models on data silos'' and frames personalisation as the response
to heterogeneity.

The post-window landmarks make that frame explicit. FedALA \citep{zhang2023fedala} initialises each client's model by an
adaptive local aggregation of the downloaded global model and the local one; FedTGP \citep{zhang2024fedtgp} replaces naive
averaging of class prototypes by trainable global prototypes with an adaptive margin, for clients with heterogeneous models;
FedAS \citep{yang2024fedas} addresses what its abstract calls intra-client and inter-client inconsistency in personalised
federated learning; and the ACM Computing Surveys survey of heterogeneous federated learning \citep{ye2024heterogeneousfl}
organises the problem by the kind of heterogeneity---data, model, network, hardware. A decentralised clustered algorithm
(DFCA, 2026) removes the server altogether. Every one of these abstracts defines its contribution against statistical
heterogeneity, and every one reports superiority over ``state-of-the-art'' baselines on the suite in which it is compared.
That is the established finding and the contested one at once: heterogeneity is the organising problem of the post-2022
literature and personalisation its dominant answer, but no common protocol fixes the levels of heterogeneity at which
methods are compared, and generalisation beyond a method's own suite is not shown (P-H-11).

\subsection{Robustness, privacy and governance}
\label{sec:sec-fl-privacy}

Robustness to malicious clients is the second thread. The backdoor attack on federated learning
\citep[preprint]{bagdasaryan2018backdoor} precedes the window; the highly cited 2025 contributions are aggregation rules---a
committee-based Byzantine-resilient scheme \citep{xu2025cbrfl} and a trimmed-mean rule---evaluated on standard benchmarks,
and the 2026 Information Fusion survey \citep{jimenezgutierrez2026flsecurity} separates security-enhancing methods (against
Byzantine, poisoning and Sybil behaviour) from privacy-preserving ones. The privacy thread rests on an attack and two
defences, all pre-window: gradient inversion \citep{zhu2020dlg} showed that model updates leak training data; secure
aggregation \citep{bonawitz2017secagg} and differential privacy \citep{abadi2016dpsgd,fu2026dpfl} are the responses. The
landmark applications in healthcare assert privacy by construction and, judging from their abstracts, evaluate no attack;
the review treats their privacy claims as speculative until such an evaluation is reported (P-H-09). The scoping review of
the governance of federated learning in healthcare \citep{eden2025flgovernance} is explicit that ``limited insights exist on
the optimal governance of this emerging technology'' (P-H-13).

\subsection{Statistics}
\label{sec:sec-fl-stats}

Federated learning is the category with the highest baseline growth of the area, from
\SecCountFederatedLearningTwoZeroOneEightMultilabel{} works in 2018 to \SecCountFederatedLearningTwoZeroTwoFiveMultilabel{} in
2025, a \SecRatioMultilabelFederatedLearningSpan-fold increase between 2022 and 2025 alone, and the only one whose interrupted
time series at the reference month shows a negative level and slope change; as Section~\ref{sec:sec-breaks} showed, neither
survives the placebo test, and the category's single Bai--Perron break is dated \SecBreakFederatedLearningBpBreaksBic{}. Its
citation structure changed more than any other in the area. The self-citation share of federated-learning works rose from
\SecFlowFederatedLearningToFederatedLearningTwoZeroOneNinePct\,\% in 2019 to
\SecFlowFederatedLearningToFederatedLearningTwoZeroTwoFivePct\,\% in 2025 as the field acquired a citable literature of its own;
the share of references to privacy-preserving computation rose to
\SecFlowFederatedLearningToPrivacyPreservingComputationTwoZeroTwoFivePct\,\%; and the share to machine-learning theory fell.
Co-classification with the LLM category rose from \SecCoocFederatedLearningLlmTwoZeroTwoTwoPct\,\% in 2022 to
\SecCoocFederatedLearningLlmTwoZeroTwoFivePct\,\% in 2025: federated fine-tuning of foundation models is visible in the labels
but not yet among the landmarks, whose 36-month windows have not closed.

\section{Convergence, evidence quality and unresolved problems}
\label{sec:sec-synthesis}

\subsection{What moved and what did not}
\label{sec:sec-synthesis-moved}

Read together, the five categories support four statements about the area and refute one that is often made about it. No
security category shows a level break at the end of 2022. The volume acceleration of cybersecurity, applied cryptography and
privacy-preserving computation is a slope change that the break detectors date to mid-2022 and to late 2024; blockchain and
federated learning broke upward in early 2020 and decelerated afterwards. The statement that security research was
transformed by the arrival of conversational language models is, on the corpus's evidence, a statement about composition
rather than volume: the share of cybersecurity works co-classified with the LLM category rose several-fold between 2022 and
2025 while the share of their references going to LLM works stayed near one per cent. The security of language-model systems
is a continuation of the security-of-machine-learning literature of 2014--2021 with a new attack surface---instructions in
data, tool use, agent protocols---and its evaluation standards are not settled. Its foundational attack papers are
preprints, and its highly cited peer-reviewed works are surveys.

Applied cryptography is the area's one dated transition, and it is dated by standards: the third-round report, the two
attacks on finalists, the 2024 FIPS publications and the 2025 fourth-round report. The transition did not move the category's
aggregate volume, which is dominated by encryption-for-devices sub-literatures of contested quality; it moved the reference
flows toward quantum computing only slightly. The fall of SIDH and Rainbow is the area's methodological lesson, and the
standards' wording (``believed to be secure'') is the one the review adopts.

Convergence is measurable where the ontology predicted it and absent where it did not. Federated learning and
privacy-preserving computation cite each other increasingly (\SecFlowFederatedLearningToPrivacyPreservingComputationTwoZeroTwoFivePct\,\%
of federated-learning references and \SecFlowPrivacyPreservingComputationToFederatedLearningTwoZeroTwoFivePct\,\% of
privacy references in 2025), and both have the area's highest co-classification with the LLM category; the convergence
hypothesis of Part~VIII (Section~\ref{sec:net-flows-categories}) finds its clearest security-side support in this pair.
Blockchain's links to the rest of computer science are weak and its self-citation share, though declining, remains the
highest of the area; its highly cited literature now lives in management and economics venues. Applied cryptography and
cybersecurity remain each other's principal partners, as they were in 2019.

\subsection{Evidence quality}
\label{sec:sec-synthesis-evidence}

The review has been explicit about the kinds of evidence behind each statement, and the claims table of the area
(\texttt{literature\_synthesis/agent\_H/claims.csv}) records, for every claim, its type (established, contested, speculative),
its evidence (corpus statistic, abstract, metadata only), the result file or record on which it rests, and a confidence.
Three limits deserve restating. Abstracts are not full texts: every statement about what a landmark paper does rests on its
abstract or title, and the review has not verified any reported result. The landmark metric is a citation metric with the
distortions documented in Section~\ref{sec:sec-landmarks}---duplicates, reprints dated 2026, venue-level records,
misclassifications, a single-topic burst in 2020, and 2026 records ranked on months of citations---so that the composition
of each category's top twenty-five is partly a property of the database (Part~III, Section~\ref{sec:data-quality}) and the
review has, where necessary, said so rather than interpreted it. And the structural-change estimates are descriptive
associations on monthly counts whose last complete month is \ItsLastComplete{}; they are reported with their placebo
distributions and alternative dates, and the review has drawn no causal conclusion from them.

\subsection{Unresolved problems}
\label{sec:sec-synthesis-problems}

The problems the review leaves open are listed, with a testable direction for each, in
\texttt{literature\_synthesis/agent\_H/open\_problems.csv} (P-H-01 to P-H-14) and feed Part~X. The most consequential for the
area are five. Whether defences against prompt injection in language-model-integrated applications can be made robust
rather than patched (P-H-01) is unresolved because the attacks arrive as data and no landmark reports a defence with a
guarantee; the testable direction is a preregistered benchmark under adaptive attackers across tool-use protocols. Whether
language-model-based detection improves on fine-tuned encoders at equal cost (P-H-02) is unresolved because the landmark
abstracts report low base accuracy and dataset-specific gains; the direction is cost-matched evaluation with temporal splits.
Whether the standardised lattice schemes will attract the kind of cryptanalysis that broke SIDH and Rainbow (P-H-04), and how
fast post-quantum key exchange is deployed (P-H-05), are questions the corpus can follow in later snapshots by citation
tracking and that Internet measurement can answer directly. Whether personalised federated-learning methods generalise
beyond their own benchmark suites (P-H-11), and whether federated systems deployed without differential privacy or secure
aggregation leak training data under gradient inversion (P-H-09), are questions whose answers require protocols the field has
not yet adopted: shared heterogeneity benchmarks reported per client, and mandatory attack evaluation in application papers.
The last open problem is the review's own: the sensitivity of every area-level landmark statistic to the deduplication of
records that the automatic selection does not perform (P-H-14), which the principal-investigator review can resolve before
Part~IX is finalised.