# Agent H — Security, privacy and cryptography: disciplinary synthesis (Phase 5, 2026-11-03)

Area: `security_privacy` (categories `cybersecurity`, `applied_cryptography`, `blockchain`, `privacy_preserving_computation`,
`federated_learning`). Inputs: `literature_synthesis/landmarks/security_privacy_landmarks.csv` (125 works, 25 per category) and
`security_privacy_abstracts.jsonl` (92 abstracts); `results/graph/category_counts_yearly.csv`, `category_flows_yearly.csv`,
`category_cooccurrence_yearly.csv`; `results/bibliometrics/cagr_by_category.csv`; `results/econometrics/breaks.csv` and
`its_results.json` (rows `cat_*`). No knowledge-graph extraction file exists for this area (`data/processed/graph/extraction/` is
empty) and no emerging-topic row concerns these categories, so every statement below rests on metadata, abstracts, or corpus
statistics; nothing rests on a full text. Numbers are quoted here for the record and enter the manuscript only through the
`\Sec...` macros appended to `manuscript/tables/numbers.tex` by `tables/make_numbers.py` and the four tables
`tab_security_counts`, `tab_security_summary`, `tab_security_llm_cooccurrence`, `tab_security_landmarks` (`tables/make_tables.py`).

## 0. Reading rules and what the inputs can and cannot support

The landmark set of this area is an automatic selection (`literature_synthesis/select_landmarks.py`): the top works by
field-normalised 36-month citations (NCS36) within each primary category, with 2025–2026 works ranked by 12-month citations
relative to their cohort. Three consequences shape everything that follows. First, the selection is blind to record quality:
duplicated, misdated and misclassified records rank as high as genuine landmarks when OpenAlex attaches citations to them.
Second, the NCS36 criterion favours survey and application papers in categories whose citing community is broad (blockchain,
federated learning), and favours standards and reports in categories where the influential documents are not journal
articles (applied cryptography). Third, 33 of the 125 records are dated 2026 and ranked on a few months of citations; their
normalised scores (up to 9,806 for an SSRN preprint without abstract) measure cohort position, not durable influence. The
synthesis therefore treats the landmark list as a *sample of what is highly cited under the corpus's own metric*, documents
its artefacts explicitly (Section 7), and complements it with the verified references of `manuscript/references.bib` where
the automatic selection missed works that any specialist would consider foundational (NIST FIPS 205, prompt-injection and
jailbreak papers, DP-SGD, secure aggregation). Abstract-level evidence is marked "the abstract reports"; works without
abstract (33 of 125) are discussed from their metadata only.

## 1. Volume and structural change across the five categories (corpus statistics)

Counts are eligible works carrying the category (multi-label) per publication year, summed over the pre/baseline/post labels
of `category_counts_yearly.csv`; primary-category counts are reported alongside in `tab_security_counts`. Cybersecurity is the
largest category of the area (78,082 works in 2022; 139,134 in 2025; 829,538 over 2018–2026), applied cryptography the second
(29,699 in 2018; 51,759 in 2025), blockchain (10,872 → 33,426), privacy-preserving computation (11,378 → 49,266) and federated
learning (1,040 → 18,093) follow. Growth profiles differ sharply. Cybersecurity and applied cryptography were nearly flat over
2018–2022 (multi-label CAGR 3.7 % and 1.9 %) and accelerated after 2023 (24.7 % and 20.4 % over 2023–2025). Privacy-preserving
computation grew throughout (15.2 % then 39.8 %). Federated learning had the steepest baseline growth of the area (54.3 %) and
remained the fastest-growing category after 2023 (45.8 %), but its growth rate fell. Blockchain is the exception: its growth was
front-loaded (16.7 % baseline, 17.3 % post, with the 2020 Bai–Perron break), and its share of primary classifications peaked
around 2020 (1.76 %) before settling (2.02 % in 2025 on a larger base; `category_share_ci_yearly.csv` places the 2023 share
above the 2025 one when confidence intervals are read).

The interrupted-time-series estimates at the 2022-12 reference month (`breaks.csv`, HAC p-values) show no level shift for any
of the five categories except federated learning (level −0.126, p = 0.007), and positive slope changes for cybersecurity
(+0.015 per month, p < 0.001), applied cryptography (+0.013), privacy-preserving computation (+0.012) and none for blockchain
(−0.002, p = 0.20) or federated learning (−0.006, p = 0.001, i.e. a deceleration). The placebo distribution over 65 alternative
event months qualifies these: the slope t-statistic at 2022-12 ranks 3rd of 65 for applied cryptography (placebo p = 0.046),
4th for cybersecurity (0.062), 9th for privacy-preserving computation (0.138), and is unremarkable for blockchain (0.508) and
federated learning (0.385); the federated-learning level drop is likewise unremarkable against placebos (0.246). Bai–Perron
(BIC) dates a single break at 2022-07 for cybersecurity, applied cryptography and privacy-preserving computation — five months
*before* the reference event — and at 2020-04 (blockchain) and 2020-02 (federated learning). PELT places changes at 2022-11
and 2024-12 for the two security categories, at 2020-12 and 2023-12 for privacy, and at 2020-02 and 2023-05 for federated
learning. The donut specification (three months excluded on each side) turns the cybersecurity and applied-cryptography
level estimates positive and significant (+0.051, p = 0.049; +0.066, p = 0.001) while leaving slopes unchanged, which indicates
that the months around the reference date are themselves unusual (indexing, not necessarily publication). Alternative event
dates tell the same story: the o1 date (2024-10) carries a large positive level coefficient for cybersecurity (+0.149, p = 0.001),
applied cryptography (+0.142) and privacy (+0.198), consistent with a late-2024 acceleration that PELT also detects (2024-12).

The reading that these results support is modest. The two "security" categories and privacy-preserving computation grew faster
after 2023 than before, the acceleration is dated by the break detectors to mid-2022 and to late 2024 rather than to a single
month, and the growth is partly compositional (Section 6: the share of their works co-classified with the LLM category rose from
1.7 % in 2022 to 7.6 % in 2025 for cybersecurity and from 1.4 % to 9.3 % for privacy). Blockchain and federated learning are
stories of the baseline period: both broke upward in early 2020 and neither shows a post-2022 acceleration. None of this is
causal evidence about ChatGPT; the manuscript's structural-change design (Part IV) is explicit that the reference month is a
convention.

## 2. Cybersecurity

**What the landmark set contains.** The 25 cybersecurity landmarks are a heterogeneous set: ten are grey literature (five
dissertations, four book chapters, one report), five have no DOI, and nine are dated 2026. The highest-ranked record is a 2026
SSRN preprint on persistent homology as a prompt-injection defence (no abstract; NCS36 9,806 on 252 citations within months),
which cannot be assessed from metadata and is flagged for PI review. Two records are misclassified: *Fedformer* (a long-term
time-series forecasting Transformer, reissued as a 2026 CRC chapter) and a 2018 book chapter on *Enigma* (a secure-computation
platform that belongs to privacy-preserving computation). A 2023 IT Professional record titled "IEEE Symposium on Security and
Privacy" (853 citations in 36 months, no abstract) is a venue-level record, not a paper. These artefacts are consistent with the
Part III finding that OpenAlex attaches citations to reprints and container records.

**Pre-window landmarks.** The genuine baseline landmarks are the adversarial-examples chapter of Kurakin, Goodfellow and Bengio
(a 2018 reprint of the 2017 workshop paper; the abstract reports that adversarial examples survive printing and camera capture,
i.e. transfer to the physical world), the CIC-IDS2017 intrusion-detection dataset paper (no abstract; 534 citations in 36 months,
the single most reused benchmark of the network-intrusion literature), two 2018 IEEE surveys on blockchain for IoT and on the
security and privacy of Bitcoin (both abstracts describe surveys), and a 2018 healthcare-cloud blockchain position paper. The
baseline cybersecurity literature, as sampled by NCS36, was thus dominated by (i) machine-learning-based detection on shared
datasets and (ii) blockchain-as-security-solution surveys — not by the microarchitectural attacks (Spectre, Meltdown) that the
verified reference list records as the field's 2018 landmarks; those are classified in computer architecture or receive their
citations outside the 36-month window.

**Post-window landmarks and the LLM-security turn.** The post-2023 landmarks with abstracts cluster on large language models
used *for* security and on the security *of* LLM systems. On the first side: *vul-rag* (ACM TOSEM 2026; the abstract reports
that LLMs distinguish vulnerable from patched code with 0.06–0.14 accuracy and that knowledge-level retrieval raises accuracy by
16–24 points), *HuntGPT* (anomaly detection with explainability and an LLM front-end), and a RoBERTa-based phishing detector
(Computer Networks 2026). On the second side: the ACM Computing Surveys survey of security and privacy challenges of LLMs
(jailbreaking, data poisoning, PII leakage; `das2025llmsecurity`), and the ACM TOSEM study of the Model Context Protocol
(a lifecycle of MCP servers in four phases and sixteen activities with a threat taxonomy; `hou2026mcp`). The verified reference
list adds the works that the automatic selection missed because they are preprints or workshop papers: indirect prompt injection
(`greshake2023injection`), prompt-injection attacks on integrated applications (`liu2023promptinjection`, preprint), the
"ignore previous prompt" attack (`perez2022ignore`), the jailbreak analysis of Wei et al. (`wei2023jailbroken`, preprint), the
universal adversarial suffix (`zou2023universal`, preprint), the one-day-exploit agent study (`fang2024oneday`, preprint),
PentestGPT (`deng2023pentestgpt`, preprint) and the surveys of Yao et al. and Shayegani et al. The corpus statistics locate this
turn: works co-classified cybersecurity × LLM rose from 1,337 (2022) to 10,549 (2025) and 14,410 in the incomplete 2026, i.e. from
1.7 % to 7.6 % and 12.0 % of cybersecurity works; co-classification with AI agents reached 5.3 % in 2026. Citation flows show the
same thing more weakly: 0.7 % of references from cybersecurity works went to LLM-category works in 2025 (1.1 % in 2026), against
47.5 % to cybersecurity itself.

**Assessment.** Established: the security-of-ML literature predates the window (adversarial examples, membership inference,
training-data extraction), and the post-2022 LLM-security literature extends it to a new attack surface (instructions in data,
tool use, agent protocols). Contested: whether LLM-based detection improves on fine-tuned encoders or classical features at equal
cost — the vul-rag abstract itself reports very low base accuracy, and the phishing and HuntGPT abstracts report gains on
specific datasets. Speculative: claims that defences against prompt injection can be made robust; the only landmark on the
question (the 2026 SSRN preprint) argues a negative result and has not been reviewed. The corpus cannot yet tell whether the
LLM-security literature is a durable subfield or a labelling wave; its first 36-month citation windows close in 2026–2027.

## 3. Applied cryptography

**Standards as landmarks.** The applied-cryptography landmark set is the clearest case of a category whose most cited documents
are standards and reports rather than papers: RFC 8446 (TLS 1.3, 2018; abstract: "prevent eavesdropping, tampering, and message
forgery"), the NIST status reports on the first (2019) and third (2022) rounds of the post-quantum standardisation process, and
the two 2024 Federal Information Processing Standards FIPS 203 (ML-KEM; the abstract ties its security to Module-LWE and states
that it "is believed to be secure, even against adversaries who possess a quantum computer") and FIPS 204 (ML-DSA, with the same
belief statement for signatures). FIPS 205 (SLH-DSA, hash-based) is not in the landmark set but is in the verified references
(`nist2024fips205`). The 2024 draft transition report (`nist2024transition`) and the fourth-round status report (`nist2025hqc`)
complete the sequence; the latter was not read in full text here and is cited for its existence and date.

**The timeline the corpus records.** The post-quantum programme is the one development of the area with an unambiguous timeline
inside the observation window: the third-round report (July 2022) announced the selections, two attacks on candidates
appeared in the same year — the key-recovery attack on SIDH of Castryck and Decru (EUROCRYPT 2023; no abstract in the record;
title only) and Beullens's attack on Rainbow ("takes a weekend on a laptop", CRYPTO 2022) — and the final standards were
published in August 2024. The corpus statistics show that this timeline did not translate into an aggregate volume break:
applied cryptography's Bai–Perron break (2022-07) coincides with the NIST announcement month but the category's post-2023
growth (20.4 %) is driven by the much larger encryption-for-IoT and chaos-based image-encryption sub-literatures (see below),
and the flow of references from applied cryptography to quantum computing rose only from 2.8 % (2019) to 4.1 % (2025). The
theoretical base of the lattice standards (Regev's LWE, `regev2009lwe`; Shor's algorithm as the threat model, `shor1997factoring`)
lies outside the corpus window; the 2024–2025 below-threshold error-correction result (`googlequantum2025belowthreshold`) is the
window's main quantum-side event and is classified in quantum computing, not here.

**What else the landmark set contains.** Three 2025–2026 landmarks are chaos-based or neuron-model image/video encryption
schemes (IEEE TDSC, IEEE TCE, Nonlinear Dynamics) and one is a cryptanalysis of such a scheme (ACM TOMM 2026; the abstract
reports that "many such systems lack standardization and deviate from secure design principles"). This sub-literature is
large in the corpus (OpenAlex topic T11017 is mapped to the category at weight 0.7) and its presence among the most cited
2026 works is a fact about the citing community, not an endorsement; the ontology note records the same reservation. Other
records are artefacts: a 2022 reprint of Diffie–Hellman's 1976 *New Directions* (the "abstract" is the ACM landing page), a
2026 record of TLS 1.3 with the text of an older protocol version, a 2026 ResearchHub copy of the 2010 Scantegrity II paper,
a 2026 Warwick repository record of the 2010 FLINT library, a Reed–Solomon FPGA dissertation, and a 2020 LNCS reprint of *Deep
Leakage from Gradients* (which belongs with federated-learning privacy and is discussed in Section 5). One 2026 Information
Fusion survey on the security and privacy of federated learning (203 papers, per its abstract) is classified here because of its
cryptographic keywords.

**Assessment.** Established: lattice-based KEM and signature standards exist and are deployed in TLS-style key exchange (the
corpus records the standards; deployment is not in evidence here). Established and important as a methodological lesson:
two of the finalists fell to classical attacks after years of scrutiny, so "post-quantum" denotes a threat model, not a
security proof. Contested within the corpus: the security of the large chaos-based encryption literature, which its own
cryptanalyses dispute. Not addressed by the corpus's landmark metric: homomorphic encryption, zero-knowledge proofs and MPC as
primitives — the verified references (`gentry2009fhe`, `cheon2017ckks`, `chillotti2020tfhe`, `groth2016snark`, `thaler2022proofs`,
`evans2018mpc`) carry this lineage; their post-2022 progeny do not surface in the top-25 because their citing communities are
small and their venues (IACR ePrint, TCHES) are partially mapped.

## 4. Blockchain systems

**Shape of the literature.** Blockchain is the category whose landmark set is least about computer science: of 25 works, two
are in the *Review of Financial Studies* (illegal activity financed through bitcoin, estimated at about one quarter of users in
the abstract; blockchain disruption and smart contracts, a theory of decentralised consensus and competition), one in the
*Journal of Institutional Economics* (blockchains as an "institutional technology"), one in *International Journal of
Production Research* (sustainable supply chains), one in *Trends in Food Science & Technology* (agri-food supply chains), one in
*ACM TMIS* (business process management, with seven research directions), one in *Intelligent Systems in Accounting, Finance
and Management* (ontology-driven provenance), plus MIT Press and Springer chapters. The computer-science core is thin but
clear: Hyperledger Fabric (EuroSys 2018; "a modular and extensible open-source system for permissioned blockchains"), the IEEE
Access survey of consensus mechanisms and mining strategy management (2019), the NIST blockchain overview (2018), Guo and Yu's
survey of blockchain security (2022), and — the only 2026 technical landmark — a Datalog-based detector of cross-function
reentrancy over EVM execution traces (FMBC 2026, extending TxSpector). Post-window landmarks are reviews (blockchain for the
metaverse, 2023, 763 citations in 36 months; blockchain in healthcare; two 2024 papers in a journal with 449 citations each that
the PI should examine) and the NFT overview preprint (2021).

**Artefacts.** The Bitcoin whitepaper appears three times (SSRN records dated 2019, 2022 and 2024 with 7,534, 10,307 and 200
citations in 36 months) plus once as a Springer "recommends" chapter; the 2022 record is the single most cited work of the
whole area under c36. These are the same 2008 document (`nakamoto2008bitcoin` in the verified references), and their citation
counts belong to it. A 2026 SSRN "Global Blockchain Benchmarking Study" record (NCS36 1,481) has no abstract and is likely a
reissue of the 2017 Cambridge study.

**Corpus statistics.** Blockchain's break is in 2020-04 (Bai–Perron) with PELT changes in 2019-02 and 2022-12; the ITS at
2022-12 shows no level or slope change, and the pre-period slope (+0.015 per month) was the steepest of the five categories
after federated learning. The self-citation share of blockchain works fell from 61.4 % (2019) to 57.2 % (2025) while the share of
references to cybersecurity rose (8.5 % → 9.2 %); co-classification with the LLM category is the lowest of the area (3.1 % in
2025). DeFi, MEV and layer-2 research — present in the verified references through `werner2022defi` — does not reach the top-25 of
a category whose citing community is dominated by application and management journals.

**Assessment.** Established: the category grew fastest before 2021 and has grown at the corpus's average rate since; its highly
cited post-2022 works are reviews. Contested: whether the smart-contract security literature (reentrancy detection and the like)
constitutes progress beyond the tools of 2018–2020 — the single 2026 landmark reports an extension of an existing framework, and
no landmark reports measured vulnerability rates. Speculative: every claim about blockchain and the metaverse or AI integration
in the 2023–2026 reviews.

## 5. Privacy-preserving computation

**Composition.** The category's landmarks split into four groups. (i) Federated learning as privacy technology: Yang et al.'s
*Federated Machine Learning* (ACM TIST 2019; horizontal, vertical and transfer federated learning; 1,382 citations in 36 months,
the most cited technical paper of the area), SplitFed (AAAI 2022; split learning plus federated learning), a 2026 systematic
review of differentially private federated learning (ACM CSUR), hierarchical federated learning with two-stage DP for cloud
anomaly detection (2026) and several federated healthcare applications. (ii) The 2020 contact-tracing burst: a survey of
COVID-19 contact-tracing apps (IEEE Access), the TraceTogether privacy analysis (arXiv preprint), a cross-country acceptability
survey (JMIR), a *Nature Medicine* comment on responsible use of digital data, an OECD policy note and a German-language chapter
on the Corona-Warn-App — six of 25 landmarks from a single year's topic (OpenAlex T12943 is mapped at weight 0.5). (iii)
Privacy of models and data: the survey of machine unlearning (ACM TIST 2025; "the right to be forgotten"), differential privacy
for medical deep learning (npj Digital Medicine 2026; the abstract reports clinically acceptable performance at ε ≈ 10 and
substantial loss at ε ≈ 1), private information retrieval with side information (dissertation), privacy-aware mobile service
recommendation (2018). (iv) Misclassifications: three 2025–2026 papers on artificial intelligence in higher education and one on
AI in auditing (*Education Sciences*, *Frontiers in Psychology*, *Frontiers in Education*, *International Journal of Accounting
Information Systems*), each ranked among the top of the category by NCS36. Their abstracts mention privacy as one concern among
many; the keyword rule of the category fired on "privacy" with an education or auditing qualifier that the exclusion list does
not veto. Two further records (open-circuit fault diagnosis of power converters; mental-health prediction with a federated
CNN–BiLSTM) are applications whose privacy content is the federated setting.

**Lineage outside the window.** Differential privacy (`dwork2006dp`, `dwork2014dp`), DP-SGD (`abadi2016dpsgd`), membership
inference (`shokri2017membership`), training-data extraction from language models (`carlini2021extracting`, preprint) and
web-scale poisoning (`carlini2024poisoning`) are in the verified references and define the attack and defence vocabulary that
the post-2022 landmarks apply. The 2026 DP-FL review and the medical DP review are the only landmarks that synthesise this
vocabulary; the rest are applications.

**Corpus statistics.** Privacy-preserving computation grew throughout (15.2 % then 39.8 %) with a Bai–Perron break at 2022-07
and PELT changes at 2020-12 (the contact-tracing year) and 2023-12. Its self-citation share fell from 32.5 % (2019) to 24.4 %
(2025) — the lowest of the area — while references to federated learning (6.1 % in 2025) and LLM works (2.2 % in 2026) rose; its
works are co-classified with LLM at 9.3 % (2025), the highest rate of the area, and with AI safety at a similar rate. The category
is therefore the one whose boundary with machine learning moved most during the window.

**Assessment.** Established: DP and federated learning are the two privacy technologies that the applied literature adopts, and
the accuracy cost of strict DP budgets is documented by reviews. Contested: the privacy guarantees of federated learning without
DP or secure aggregation (gradient inversion, Section 5 of the federated-learning synthesis). Speculative: the "privacy by
design" claims of federated healthcare applications that report no attack evaluation. Data-quality finding: the category's
NCS36 ranking is contaminated by non-computing papers and by a single-topic burst; the PI review should reclassify the four
education/auditing papers and consider the contact-tracing topic weight.

## 6. Federated learning

**From averaging to heterogeneity.** The landmark set reads as the field's own history. Baseline: healthcare applications
(federated learning in medicine, Scientific Reports 2020, multi-institutional collaboration without sharing patient data;
FedHealth, a federated transfer-learning framework for wearables; healthcare informatics review), the fairness objective q-FFL
(ICLR 2020; the corpus record has no DOI and the verified reference is the arXiv preprint), the IoT survey, the KBS survey (no
abstract), the non-IID survey (Neurocomputing 2021), *Towards Personalized Federated Learning* (IEEE TNNLS 2022; "the leading
paradigm for the training of machine learning models on data silos"), and a Hong Kong dissertation on attack-adaptive
aggregation. Post-window: FedALA (AAAI 2023; adaptive local aggregation to initialise personalised models), the ACM CSUR survey
of heterogeneous federated learning (data, model, network and hardware heterogeneity), FedTGP (AAAI 2024; trainable global
prototypes for model-heterogeneous clients), FedAS (CVPR 2024; intra- and inter-client inconsistency in personalised FL), DFCA
(IEEE IoTJ 2026; decentralised clustered FL without a server), committee-based Byzantine-resilient FL (JNCA 2025) and
trimmed-mean aggregation (ESWA 2025), asynchronous FL for SAR imagery (IEEE TMC 2026), a scoping review of governance of FL in
healthcare (npj Digital Medicine 2025), and three 2026 surveys. FedAvg (`mcmahan2017fl`), the 2021 *Advances and Open Problems*
survey (`kairouz2021fl`), FedProx (`li2018fedprox`, preprint), secure aggregation (`bonawitz2017secagg`), the backdoor attack
(`bagdasaryan2018backdoor`, preprint) and gradient leakage (`zhu2020dlg`) are the verified pre-window references that the
post-window landmarks build on.

**Corpus statistics.** Federated learning is the category with the highest baseline growth (54.3 % CAGR, 1,040 works in 2018 to
18,093 in 2025, a 3.07-fold increase between 2022 and 2025) and the only one whose ITS at 2022-12 shows a negative level and
slope change; neither survives the placebo test (p = 0.246 and 0.385), and Bai–Perron dates the category's single break at
2020-02. The field's citation structure changed more than any other: its self-citation share rose from 10.8 % (2019) to 16.0 %
(2025) as it became citable, references to privacy-preserving computation rose to 15.5 %, and references to ML theory fell from
17.6 % to 13.0 %. Co-classification with LLM rose from 1.5 % (2022) to 7.6 % (2025): federated fine-tuning of foundation models
is visible in the labels but not yet among the landmarks.

**Assessment.** Established: statistical heterogeneity (non-IID clients) is the organising problem of the post-2022 literature,
and personalisation (local aggregation, prototypes, clustering) its dominant answer; the abstracts of FedALA, FedTGP, FedAS and
DFCA all define their contribution against this problem. Established but under-evaluated in the landmarks: robustness to
malicious clients, where the highly cited 2025 contributions are aggregation rules evaluated on standard benchmarks. Contested:
whether personalised FL methods generalise beyond the benchmark suites in which they are compared (each abstract reports
superiority over "state-of-the-art" baselines on its own suite). Speculative: deployment claims in healthcare, where the 2025
governance review finds that "limited insights exist on the optimal governance" of the technology.

## 7. Cross-cutting synthesis and data-quality findings

1. *No security category shows a post-2022 level break.* The volume acceleration of cybersecurity, applied cryptography and
   privacy-preserving computation is a slope change dated by break detectors to mid-2022 and late 2024; blockchain and
   federated learning broke in early 2020 and decelerated after. This is association, not causation.
2. *The LLM turn in security is compositional.* The share of cybersecurity works co-classified with LLM rose roughly fourfold
   between 2022 and 2025; citation flows to LLM works remain small (≤ 1.1 %). The security of LLM systems is a continuation of
   the security-of-ML literature with a new attack surface; its evaluation standards are not yet settled (Section 2).
3. *Standards, not papers, are the landmarks of applied cryptography*, and the post-quantum programme is the area's one
   dated transition; the fall of SIDH and Rainbow is the area's methodological lesson.
4. *Convergence between privacy-preserving computation and federated learning is measurable in flows* (15.5 % of FL references
   to privacy, 6.1 % the other way), while blockchain's links to the rest of computer science are weak and declining in share.
5. *Landmark-set artefacts*: duplicated whitepaper records (Bitcoin ×3, TLS 1.3 ×2), reprints dated 2026 (Scantegrity, FLINT,
   Diffie–Hellman 2022), venue-level records (IEEE S&P 2023), misclassifications (Fedformer; four education/auditing papers;
   Enigma), a single-topic burst (contact tracing 2020), and 2026 records ranked on months of citations. 33 of 125 records have
   no abstract. The PI review (H-3) should remove or merge these before any landmark-level statistic is reported.
6. Unresolved problems are listed in `open_problems.csv` (P-H-01 to P-H-12) and feed Part X.