1% ============================================================================2% part07b_security.tex — Part VII, security half (cybersecurity, applied cryptography incl. post-quantum3% standardisation, blockchain systems, privacy-preserving computation, federated learning, security of LLM systems).4% Written by Agent H (Security Specialist), WP44, 2026-11-03, from literature_synthesis/agent_H/review.md.5% Bibliography: references_part07b.bib (every key verified; references_verification_part07b.csv) plus keys of references.bib.6% Corpus quantities only through the \Sec... and \ItsSeriesCat... macros of tables/numbers.tex and the generated tables7% tab_security_counts, tab_security_summary, tab_security_llm_cooccurrence, tab_security_landmarks (tables/make_tables.py).8% The director merges this file with part07a_theory.tex into part07_theory_security.tex.9% ============================================================================1011\section{Security, privacy and cryptography: scope and reading rules}12\label{sec:sec-scope}1314The security half of this part reviews five categories of the ontology (Part~IV, Section~\ref{sec:m-classification}):15cybersecurity, applied cryptography, blockchain systems, privacy-preserving computation and its child category federated16learning. Together they form the \emph{security and privacy} area of the taxonomy. The five are related by subject matter17but not by size, growth or citation structure, and one purpose of this review is to show that the area is heterogeneous18enough that no single statement about ``security research after 2022'' is defensible. A second purpose is methodological:19the area's automatically selected landmark set is the one in which the limits of citation-based selection are most visible,20and the review documents those limits before it uses the set.2122Three reading rules govern what follows. First, every quantitative statement comes from a result file of the corpus23through a generated macro or table; the macros of this part are listed in \texttt{tables/make\_numbers.py} under the Part~VII-b24block and the four tables under \texttt{tables\_part07b} of \texttt{tables/make\_tables.py}. Second, the works discussed are known25through their bibliographic metadata and, for \SecLandWithAbstractPct\,\% of the landmark set, through their abstracts; no full26text was read for this review, and wording such as ``the abstract reports'' marks the boundary. Third, works that are27preprints are called preprints: several of the most important papers on the security of language-model systems have no28peer-reviewed version in the corpus, and the review treats them as the field does, as influential but unreviewed.2930\subsection{Volume}31\label{sec:sec-volume}3233Table~\ref{tab:security_counts} gives, for each category and publication year, the number of eligible works that carry the34category (multi-label) and the number for which it is the primary category. Cybersecurity is the largest category of the35area by a wide margin: \SecCountCybersecurityTwoZeroTwoTwoMultilabel{} works carried the label in 2022 and36\SecCountCybersecurityTwoZeroTwoFiveMultilabel{} in 2025, \SecCountCybersecurityAllMultilabel{} over 2018--2026, and its share37of primary classifications in the corpus moved from \SecSharePrimaryCybersecurityTwoZeroOneEightPct\,\% in 2018 to38\SecSharePrimaryCybersecurityTwoZeroTwoFivePct\,\% in 2025. Applied cryptography is the second category; blockchain and39privacy-preserving computation are of similar size in 2018 and diverge afterwards; federated learning, which barely existed40as a labelled literature in 2018 (\SecCountFederatedLearningTwoZeroOneEightMultilabel{} works), reached41\SecCountFederatedLearningTwoZeroTwoFiveMultilabel{} works in 2025.4243The growth profiles are the first evidence of heterogeneity (Table~\ref{tab:security_summary}, which also restates the44category rows of Table~\ref{tab:breaks}). Over the baseline years 2018--2022 the two security categories were nearly flat:45compound annual growth of the multi-label count was \SecCagrMultilabelCybersecurityBaselinePct\,\% for cybersecurity and46\SecCagrMultilabelAppliedCryptographyBaselinePct\,\% for applied cryptography. Over 2023--2025 both grew faster47(\SecCagrMultilabelCybersecurityPostPct\,\% and \SecCagrMultilabelAppliedCryptographyPostPct\,\%). Privacy-preserving48computation grew throughout (\SecCagrMultilabelPrivacyPreservingComputationBaselinePct\,\% then49\SecCagrMultilabelPrivacyPreservingComputationPostPct\,\%). Federated learning had the steepest baseline growth of the area50(\SecCagrMultilabelFederatedLearningBaselinePct\,\%) and remained the fastest-growing category after 202351(\SecCagrMultilabelFederatedLearningPostPct\,\%), but its growth rate fell. Blockchain is the exception to the post-202352acceleration: its growth was front-loaded (\SecCagrMultilabelBlockchainBaselinePct\,\% then53\SecCagrMultilabelBlockchainPostPct\,\%), and its share of primary classifications peaked around 202054(\SecSharePrimaryBlockchainTwoZeroTwoZeroPct\,\%) before settling at \SecSharePrimaryBlockchainTwoZeroTwoFivePct\,\% in 2025 on a55larger corpus. The 2026 row of every table is incomplete, for the indexing reasons documented in Part~III56(Section~\ref{sec:data-dates}), and no growth rate in this part uses it.5758Primary-category counts are systematically lower than multi-label counts, by a factor that itself carries information: for59cybersecurity the primary count is less than half the multi-label count, because the category co-occurs with computer60networks, computer vision (detection models) and applied cryptography; for federated learning the ratio is lower still,61because the category is a child of privacy-preserving computation and most of its works also carry machine-learning62labels. Growth rates computed on primary counts (the convention of Table~\ref{tab:cagr}) and on multi-label counts63therefore differ: on primary counts cybersecurity grew at \SecCagrPrimaryCybersecurityBaselinePct\,\% over 2018--2022 and64\SecCagrPrimaryCybersecurityPostPct\,\% over 2023--2025. The qualitative pattern is the same under both conventions, and the65multi-label series is used below because the structural-change estimates of Part~IV are computed on it.6667\subsection{Structural change}68\label{sec:sec-breaks}6970The interrupted-time-series estimates at the 2022-12 reference month (Part~IV, Section~\ref{sec:m-its}) are reported in71Table~\ref{tab:security_summary}. Writing the log monthly count as $y_t = \alpha + \beta t + \gamma D_t + \delta (t - t_0) D_t +72\varepsilon_t$ with $D_t$ the post-event indicator, the level coefficient $\gamma$ is not distinguishable from zero for73cybersecurity (\ItsSeriesCatCybersecurityItsChatgptLevelChange, $p = \ItsSeriesCatCybersecurityItsChatgptLevelP$), applied74cryptography (\ItsSeriesCatAppliedCryptographyItsChatgptLevelChange, $p = \ItsSeriesCatAppliedCryptographyItsChatgptLevelP$),75blockchain (\ItsSeriesCatBlockchainItsChatgptLevelChange, $p = \ItsSeriesCatBlockchainItsChatgptLevelP$) or privacy-preserving76computation (\ItsSeriesCatPrivacyPreservingComputationItsChatgptLevelChange,77$p = \ItsSeriesCatPrivacyPreservingComputationItsChatgptLevelP$). Federated learning is the exception, with a negative level78coefficient (\ItsSeriesCatFederatedLearningItsChatgptLevelChange, $p = \ItsSeriesCatFederatedLearningItsChatgptLevelP$) and a79negative slope change (\ItsSeriesCatFederatedLearningItsChatgptSlopeChange, $p = \ItsSeriesCatFederatedLearningItsChatgptSlopeP$)80against a steep pre-period slope of \ItsSeriesCatFederatedLearningItsChatgptPreSlope{} per month: the category decelerated. The81slope coefficient $\delta$ is positive and precisely estimated for cybersecurity82(\ItsSeriesCatCybersecurityItsChatgptSlopeChange{} per month, against a pre-period slope of83\ItsSeriesCatCybersecurityItsChatgptPreSlope), applied cryptography (\ItsSeriesCatAppliedCryptographyItsChatgptSlopeChange) and84privacy-preserving computation (\ItsSeriesCatPrivacyPreservingComputationItsChatgptSlopeChange), and null for blockchain85(\ItsSeriesCatBlockchainItsChatgptSlopeChange, $p = \ItsSeriesCatBlockchainItsChatgptSlopeP$). A slope change $\delta$ on the log86series compounds to a factor $e^{12\delta}$ per year relative to the pre-period trend, so these are not small effects; what87they are not is evidence that the change occurred in December 2022.8889The placebo distribution over \ItsSeriesCatCybersecurityPlaceboChatgptNPlacebo{} alternative event months90(Section~\ref{sec:m-placebo}) is the first qualification. The slope $t$-statistic at the reference month ranks91\ItsSeriesCatAppliedCryptographyPlaceboChatgptSlopeTRank{}th of the placebo set for applied cryptography (placebo92$p = \ItsSeriesCatAppliedCryptographyPlaceboChatgptSlopeTPlaceboP$), \ItsSeriesCatCybersecurityPlaceboChatgptSlopeTRank{}th for93cybersecurity ($p = \ItsSeriesCatCybersecurityPlaceboChatgptSlopeTPlaceboP$) and94\ItsSeriesCatPrivacyPreservingComputationPlaceboChatgptSlopeTRank{}th for privacy-preserving computation95($p = \ItsSeriesCatPrivacyPreservingComputationPlaceboChatgptSlopeTPlaceboP$); for blockchain and federated learning the96reference month is unremarkable (slope placebo $p = \ItsSeriesCatBlockchainPlaceboChatgptSlopeTPlaceboP$ and97\ItsSeriesCatFederatedLearningPlaceboChatgptSlopeTPlaceboP), and the federated-learning level drop is likewise unremarkable98(level placebo $p = \ItsSeriesCatFederatedLearningPlaceboChatgptLevelTPlaceboP$). The break detectors are the second99qualification. Bai--Perron with BIC selection (Section~\ref{sec:m-bp}) dates a single break at100\SecBreakCybersecurityBpBreaksBic{} for cybersecurity, at \SecBreakAppliedCryptographyBpBreaksBic{} for applied cryptography and101at \SecBreakPrivacyPreservingComputationBpBreaksBic{} for privacy-preserving computation---five months before the reference102event---and at \SecBreakBlockchainBpBreaksBic{} and \SecBreakFederatedLearningBpBreaksBic{} for blockchain and federated103learning, which are breaks of the pandemic period, not of the window. PELT places change points at104\SecBreakCybersecurityPelt{} for cybersecurity and \SecBreakAppliedCryptographyPelt{} for applied cryptography, at105\SecBreakPrivacyPreservingComputationPelt{} for privacy-preserving computation and at \SecBreakFederatedLearningPelt{} for106federated learning. The donut specification, which drops three months on either side of the reference date, turns the level107coefficients of cybersecurity (\ItsSeriesCatCybersecurityItsChatgptDonutLevelChange,108$p = \ItsSeriesCatCybersecurityItsChatgptDonutLevelP$) and applied cryptography109(\ItsSeriesCatAppliedCryptographyItsChatgptDonutLevelChange, $p = \ItsSeriesCatAppliedCryptographyItsChatgptDonutLevelP$)110positive while leaving the slopes unchanged, which says that the months around the reference date are themselves unusual.111Among the alternative event dates (Section~\ref{sec:m-altdates}) the one that carries a large positive level coefficient112for all three accelerating categories is the latest, 2024-10 (cybersecurity \SecBreakCybersecurityOOneLevel,113$p = \SecBreakCybersecurityOOneLevelP$; applied cryptography \SecBreakAppliedCryptographyOOneLevel; privacy-preserving computation114\SecBreakPrivacyPreservingComputationOOneLevel), consistent with the late-2024 change points of PELT.115116The reading these estimates support is deliberately modest. The two security categories and privacy-preserving computation117grew faster after 2023 than before; the acceleration is dated by the detectors to mid-2022 and to late 2024 rather than to118a single month; and part of it is compositional, in the sense developed in Section~\ref{sec:sec-cyber-llm}, where the share119of these categories' works co-classified with the LLM category is shown to have risen several-fold. Blockchain and federated120learning are stories of the baseline period: both broke upward in early 2020 and neither accelerated after 2022. None of121this is causal evidence about any product release; the reference month is a convention of the design (Part~IV), and the122present part uses it only as a date.123124\subsection{The landmark sample and its limits}125\label{sec:sec-landmarks}126127The landmark set of the area (Table~\ref{tab:security_landmarks}) contains \SecLandN{} works, twenty-five per category,128selected automatically as the works with the highest field-normalised 36-month citation score within each primary category129\citep{waltman2019fieldnormalization,wang2013citationwindow}, with 2025--2026 works ranked by 12-month citations relative to130their cohort (Part~IV, Section~\ref{sec:m-citations}). Three properties of this selection shape the review. The metric is131blind to record quality: a duplicated, misdated or misclassified record ranks as high as a genuine landmark when the132database attaches citations to it, and the area contains conspicuous cases---the Bitcoin whitepaper133\citep{nakamoto2008bitcoin} appears as three distinct SSRN records dated 2019, 2022 and 2024, TLS~1.3 appears twice, a 2010134election case study and a 2010 number-theory library appear as 2026 repository records, a venue (``IEEE Symposium on Security135and Privacy'') appears as a 2023 work, and a time-series forecasting architecture is filed under cybersecurity. The metric136favours surveys and application papers in categories whose citing community is broad (blockchain, federated learning) and137favours standards and reports where the influential documents are not articles (applied cryptography):138\SecLandTypeReport{} of the \SecLandN{} records are reports, \SecLandTypeBookChapter{} are book chapters and139\SecLandTypeDissertation{} are dissertations, against \SecLandTypeArticle{} journal articles. And \SecLandYearTwoZeroTwoSix{}140records are dated 2026 and ranked on a few months of citations; their normalised scores measure position in a cohort, not141durable influence. \SecLandNoDoi{} records have no DOI.142143The review therefore treats the landmark list as a sample of what is highly cited under the corpus's own metric,144documents its artefacts category by category, and supplements it with the verified references of the main bibliography where145the automatic selection missed works that a specialist would consider foundational---the hash-based signature standard,146the prompt-injection and jailbreak papers, differentially private stochastic gradient descent, secure aggregation. The147contributions table of the area (\texttt{literature\_synthesis/agent\_H/contributions.csv}) records, for each landmark, whether148its contribution type was judged from the abstract or from metadata alone; \SecLandWithAbstractPct\,\% of the records have an149abstract. The principal-investigator review of the landmark set (protocol checkpoint H-3) should act on the artefacts150listed here before any landmark-level statistic is reported in Part~IX.151152\section{Cybersecurity}153\label{sec:sec-cyber}154155\subsection{The baseline literature as the citation metric sees it}156\label{sec:sec-cyber-baseline}157158The pre-window cybersecurity landmarks are not the works a security researcher would name first. The microarchitectural159attacks of 2018, Spectre and Meltdown \citep{kocher2019spectre,lipp2018meltdown}, are in the verified bibliography but not in160the category's top twenty-five: they are classified under computer architecture by the ontology, and their citations161accrue in venues the cybersecurity mapping weights partially. What the metric selects instead is, first, machine-learning162detection on shared datasets---the CIC-IDS2017 intrusion-detection dataset paper, which has no abstract in the record and163which is, by its 36-month citation count, the single most reused benchmark of the network-intrusion literature---and,164second, surveys that present distributed ledgers as a security solution: the IEEE Access review of blockchain for the165Internet of Things \citep{fernandez2018biot}, the IEEE Communications Surveys and Tutorials survey of the security and privacy166of Bitcoin \citep{conti2018bitcoinsecurity}, and a healthcare-cloud position paper \citep{esposito2018healthcare}. The167third baseline landmark is the chapter version of \citet{kurakin2018physical}, a 2018 reprint of the 2017 workshop paper on168adversarial examples in the physical world; its abstract reports that adversarial perturbations survive printing and camera169capture, so that the threat demonstrated in the digital setting by \citet{szegedy2014intriguing} and170\citet{goodfellow2015fgsm} transfers to deployed sensors. This is the only baseline landmark of the category that belongs to171the security of machine learning, and it matters because the post-2022 literature of the category is largely an extension172of that line.173174Ten of the twenty-five cybersecurity landmarks are grey literature (dissertations, book chapters, a report), five have no175DOI and nine are dated 2026; the composition is the most irregular of the five categories. The record with the highest176normalised score in the whole area is a 2026 SSRN preprint on persistent homology as a prompt-injection defence, without177abstract, that accumulated its citations within months; it cannot be assessed from metadata, it is not peer-reviewed, and it178is flagged for the principal-investigator review rather than discussed.179180\subsection{The security of language-model systems}181\label{sec:sec-cyber-llm}182183The post-2023 cybersecurity landmarks with abstracts cluster in two groups: language models used \emph{for} security184tasks and the security \emph{of} language-model systems. In the first group, the ACM Transactions on Software Engineering185and Methodology paper on Vul-RAG \citep{du2026vulrag} is the most informative, because its abstract reports a negative186result before its positive one: large language models distinguish vulnerable code from similar-but-benign patched code with187an accuracy of 0.06--0.14, and knowledge-level retrieval augmentation---retrieving abstracted vulnerability knowledge from188historical fixes---raises that accuracy by 16--24 points. HuntGPT \citep{ali2026huntgpt} couples a conventional anomaly189detector with explainability tools and a language-model interface, and its abstract frames the contribution as190acceptance by incident responders rather than detection accuracy; a fine-tuned RoBERTa phishing-email detector191\citep{uddin2026phishing} reports gains on specific datasets. On the offensive side, the verified bibliography records two192preprints that the landmark metric does not reach: PentestGPT \citep{deng2023pentestgpt} and the study reporting that193language-model agents can autonomously exploit one-day vulnerabilities \citep{fang2024oneday}. Neither has a peer-reviewed194version in the corpus.195196In the second group, the ACM Computing Surveys survey of security and privacy challenges of large language models197\citep{das2025llmsecurity} organises the attack surface---jailbreaking, data poisoning, leakage of personally identifiable198information---and the ACM TOSEM study of the Model Context Protocol \citep{hou2026mcp} is the first landmark to treat the199tool-use layer of agent systems as an object of security analysis: its abstract describes a lifecycle of MCP servers in four200phases and sixteen activities and a taxonomy of threats attached to each. The foundational attack papers are, again, outside201the landmark set and inside the verified bibliography: the ``ignore previous prompt'' attack \citep{perez2022ignore},202indirect prompt injection through retrieved content \citep{greshake2023injection}, prompt injection against integrated203applications \citep[preprint]{liu2023promptinjection}, the analysis of why safety training fails204\citep[preprint]{wei2023jailbroken}, universal and transferable adversarial suffixes \citep[preprint]{zou2023universal}, and205the surveys of \citet{yao2024llmsecurity} and \citet[preprint]{shayegani2023adversarial}. The pre-window lineage of these206works is the privacy and robustness literature of the previous decade: membership inference \citep{shokri2017membership},207extraction of training data from language models \citep[preprint]{carlini2021extracting}, and the demonstration that208poisoning web-scale training sets is practical \citep{carlini2024poisoning}.209210The corpus statistics locate this turn (Table~\ref{tab:security_llm_cooccurrence}). Works co-classified as cybersecurity and211LLM represented \SecCoocCybersecurityLlmTwoZeroTwoTwoPct\,\% of cybersecurity works in 2022,212\SecCoocCybersecurityLlmTwoZeroTwoFivePct\,\% in 2025 and \SecCoocCybersecurityLlmTwoZeroTwoSixPct\,\% in the incomplete 2026;213co-classification with AI agents reached \SecCoocCybersecurityAiAgentsTwoZeroTwoSixPct\,\% in 2026, and with AI safety214\SecCoocCybersecurityAiSafetyTwoZeroTwoFivePct\,\% in 2025. The non-zero shares before 2022 are a property of the keyword rules215of the AI categories, which match pre-transformer language-model work, so the table should be read for its trend. Citation216flows record the same movement more weakly: \SecFlowCybersecurityToLlmTwoZeroTwoFivePct\,\% of the resolved references of217cybersecurity works in 2025 went to works of the LLM category (\SecFlowCybersecurityToLlmTwoZeroTwoSixPct\,\% in 2026), against218\SecFlowCybersecurityToCybersecurityTwoZeroTwoFivePct\,\% to cybersecurity itself; the inverse flow, from LLM works to219cybersecurity works, was \SecFlowLlmToCybersecurityTwoZeroTwoFivePct\,\% in 2025. The security literature is, by this measure,220labelling its objects faster than it is citing the literature that produced them.221222\subsection{Assessment}223\label{sec:sec-cyber-assessment}224225Three statements are established on the evidence available. The security-of-machine-learning literature predates the window,226and the post-2022 literature on language-model systems extends it to a new attack surface in which instructions arrive as227data, through retrieved documents, tool outputs and agent protocols. The highly cited post-2022 works of the category are,228in the main, surveys and systems papers rather than attacks; the attacks are preprints. And the category's growth after2292023 is partly a change of composition, visible in co-classification before it is visible in citation flows. One statement230is contested within the landmark abstracts themselves: whether language-model-based detection improves on fine-tuned231encoders or on classical features at equal cost, since the Vul-RAG abstract reports a very low base accuracy and the232phishing and HuntGPT abstracts report gains on particular datasets. One statement is speculative: that defences against233prompt injection can be made robust rather than patched; no landmark reports a defence with a guarantee, and the only234landmark on the question argues the negative and is unreviewed. Whether the language-model-security literature is a durable235subfield or a labelling wave is a question the corpus cannot answer yet, because the first 36-month citation windows of its2362023--2024 cohort close in 2026--2027 (open problem P-H-03).237238\section{Applied cryptography and the post-quantum transition}239\label{sec:sec-crypto}240241\subsection{Standards as landmarks}242\label{sec:sec-crypto-standards}243244Applied cryptography is the clearest case in the corpus of a category whose most cited documents are standards and reports245rather than papers. Five of its twenty-five landmarks are of that kind: RFC~8446, the specification of TLS~1.3246\citep{rescorla2018tls13}, whose abstract states the protocol's purpose as preventing ``eavesdropping, tampering, and message247forgery''; the status reports on the first and third rounds of the NIST post-quantum cryptography standardisation process248\citep{nist2019pqcround1,nist2022pqcround3}; and the two 2024 Federal Information Processing Standards FIPS~203 and FIPS~204249\citep{nist2024fips203,nist2024fips204}. The abstract of FIPS~203 relates the security of its key-encapsulation mechanism, ML-KEM,250to the computational difficulty of the module learning-with-errors problem and states that the scheme ``is believed to be251secure, even against adversaries who possess a quantum computer''; FIPS~204 makes the same statement for the ML-DSA signature252scheme. The hash-based signature standard FIPS~205 \citep{nist2024fips205} is not in the landmark set but completes the 2024253publication; the draft transition report \citep{nist2024transition} and the fourth-round status report \citep{nist2025hqc}254complete the sequence, and the latter is cited here for its date and existence only, since its content was not read.255256That the lattice standards rest on \citet{regev2009lwe} and respond to the threat model set by \citet{shor1997factoring} is257part of the pre-window lineage that Part~II records; the rationale for the programme is the one \citet{bernstein2017pqc}258set out before the window opened. The window's principal quantum-side event, the demonstration of error correction below259threshold \citep{googlequantum2025belowthreshold}, is classified under quantum computing and is discussed there. What the260corpus adds is a measurement of how little the standardisation timeline moved the category's aggregate volume: the261Bai--Perron break of applied cryptography (\SecBreakAppliedCryptographyBpBreaksBic) coincides with the month of the262third-round announcement, but the category's post-2023 growth is carried by sub-literatures that have nothing to do with263lattices (Section~\ref{sec:sec-crypto-rest}), and the share of the category's references that go to works of the264quantum-computing category rose only from \SecFlowAppliedCryptographyToQuantumComputingTwoZeroOneNinePct\,\% in 2019 to265\SecFlowAppliedCryptographyToQuantumComputingTwoZeroTwoFivePct\,\% in 2025.266267\subsection{The lesson of the broken candidates}268\label{sec:sec-crypto-breaks}269270The one landmark of the category that is an attack is the key-recovery attack on SIDH of \citet{castryck2023sidh}, published271at EUROCRYPT 2023 after circulating in 2022; the corpus record has no abstract and the work is known here by its title,272which records a key recovery against the isogeny-based scheme on which the SIKE candidate was built. The verified bibliography273adds \citet{beullens2022rainbow}, whose title records that breaking the multivariate signature candidate Rainbow ``takes a274weekend on a laptop''. Both attacks are classical. The methodological lesson is the one the review draws for the whole area:275``post-quantum'' names a threat model, not a security proof, and two of the schemes that had survived three rounds of276public scrutiny fell to attacks whose cost was measured in days. The standards' own wording---``believed to be secure''---is277the correct one, and the open problem for the category (P-H-04) is the rate at which the standardised lattice schemes attract278cryptanalysis, which the corpus can measure in later snapshots by following citations to FIPS~203 and FIPS~204.279280A second, unmeasured problem is deployment. The corpus records standards and reports; it does not record whether TLS281handshakes negotiate post-quantum key exchange, and the transition timeline of \citet{nist2024transition} is one the282literature has not yet evaluated. Internet-measurement studies of that kind belong to computer networks and are listed283among the open problems (P-H-05) rather than reviewed here.284285\subsection{The rest of the category}286\label{sec:sec-crypto-rest}287288The remaining landmarks of applied cryptography are instructive about the category's composition. Three of its 2025--2026289landmarks are chaos-based or neuron-model image and video encryption schemes, published in IEEE Transactions on Dependable290and Secure Computing, IEEE Transactions on Consumer Electronics and Nonlinear Dynamics, and one is a cryptanalysis of a291scheme of that kind in ACM Transactions on Multimedia Computing, whose abstract reports that ``many such systems lack292standardization and deviate from secure design principles''. The sub-literature is large: the ontology maps the OpenAlex293topic for chaos-based image and signal encryption to the category at reduced weight (Part~IV), and its presence among the294most cited 2026 works is a fact about the citing community rather than an endorsement; the category's own cryptanalyses295contest it, and the review records the dispute as unresolved within the corpus (P-H-06).296297Several other records are artefacts of the kind catalogued in Section~\ref{sec:sec-landmarks}: a 2022 ACM reprint of Diffie298and Hellman's 1976 \emph{New Directions in Cryptography}, whose ``abstract'' in the record is the publisher's landing page; a2992026 record of TLS~1.3 whose text describes an earlier protocol version; the 2026 repository copies of the 2010 Scantegrity~II300election case study and of the FLINT number-theory library; and a Reed--Solomon decoder dissertation. The 2020 reprint of301\emph{Deep Leakage from Gradients} \citep{zhu2020dlg}, filed here, is a gradient-inversion attack on federated updates and is302discussed with federated learning (Section~\ref{sec:sec-fl-privacy}); a 2026 Information Fusion survey of attacks and303defences in federated learning \citep{jimenezgutierrez2026flsecurity}, whose abstract reports coverage of 203 papers, is filed304here because of its cryptographic vocabulary.305306Conspicuously absent from the top twenty-five are homomorphic encryption, zero-knowledge proofs and secure multi-party307computation as primitives. Their lineage is in the verified bibliography---\citet{gentry2009fhe}, the BGV and CKKS schemes308\citep{brakerski2014bgv,cheon2017ckks}, TFHE \citep{chillotti2020tfhe}, the surveys of \citet{acar2018hesurvey} and309\citet{marcolla2022fhesurvey}, succinct arguments \citep{groth2016snark,thaler2022proofs} and the pragmatic introduction to310multi-party computation of \citet{evans2018mpc}---and their post-2022 progeny exist in the corpus; they do not surface because311their citing communities are small and their venues (the IACR ePrint archive, TCHES) are only partially mapped to the312category. The absence is a statement about the metric, not about the literature (claim C-H-36 of the claims table), and it is313one reason the review does not use the landmark set to rank sub-areas.314315\section{Blockchain systems}316\label{sec:sec-blockchain}317318\subsection{A literature that moved out of computer science}319\label{sec:sec-blockchain-shape}320321Blockchain is the category whose landmark set is least about computer science. Two of its twenty-five works are in the322\emph{Review of Financial Studies}: the estimate of \citet{foley2019bitcoin} that about a quarter of bitcoin users are involved323in illegal activity, and the theory of decentralised consensus, competition and smart contracts of \citet{cong2019smartcontracts}.324One is in the \emph{Journal of Institutional Economics}, where \citet{davidson2018institutions} argue that blockchains are an325``institutional technology'' rather than merely a general-purpose one. Supply-chain management \citep{saberi2019supplychain},326agri-food supply chains, business process management with its seven research directions \citep{mendling2018bpm},327ontology-driven provenance \citep{kim2018provenance}, and chapters from MIT Press and Springer complete the picture of a328literature whose highly cited works are read in management, economics and information-systems venues. The ontology329anticipated this: the category's OpenAlex topic is large and the mapping notes that the keyword ``blockchain'' is330unambiguous, so the classification is not at fault; the citing community is simply not the one the taxonomy was built for.331332The computer-science core among the landmarks is thin but clear. Hyperledger Fabric \citep{androulaki2018fabric}, ``a modular333and extensible open-source system for deploying and operating permissioned blockchains'', is the category's system paper; the334IEEE Access survey of consensus mechanisms and mining-strategy management \citep{wang2019consensus} and the NIST overview335\citep{yaga2018blockchain} are its reference surveys; \citet{guo2022blockchainsecurity} survey the security of the technology336itself, with a quantitative comparison of consensus algorithms and a risk analysis, per the abstract. The one technical337landmark dated 2026 is a Datalog-based detector of cross-function reentrancy over Ethereum Virtual Machine execution traces338\citep{guesmi2026reentrancy}, which its abstract describes as an extension of the TxSpector framework with new rules and a339modernised trace extractor. The post-window landmarks are otherwise reviews: blockchain for the metaverse340\citep{huynh2023metaverse}, with the highest 36-month count of any post-2022 work in the category; blockchain in healthcare;341the NFT overview preprint of \citet{wang2021nft}; and two 2024 papers in a single journal with identical citation counts that342the principal-investigator review should examine. The decentralised-finance literature that the verified bibliography343records through \citet{werner2022defi}, and the consensus theory on which permissioned ledgers rest344\citep{castro2002pbft}, do not reach the top twenty-five of a category whose citing community is dominated by application345journals.346347\subsection{Artefacts and statistics}348\label{sec:sec-blockchain-stats}349350The Bitcoin whitepaper appears three times, as SSRN records dated 2019, 2022 and 2024, and a fourth time as a Springer351``recommends'' chapter; the 2022 record is the single most cited work of the whole area by 36-month citations, and all of352these counts belong to the 2008 document \citep{nakamoto2008bitcoin}. A 2026 SSRN record titled ``Global Blockchain353Benchmarking Study'', without abstract, is in all likelihood a reissue of an earlier industry report. These duplicates are the354area's largest single distortion of landmark-level statistics (open problem P-H-14).355356The corpus statistics are those of a literature whose expansion ended before the window. The category's Bai--Perron break is357dated \SecBreakBlockchainBpBreaksBic{}, its PELT change points are \SecBreakBlockchainPelt{}, and the interrupted time series358at 2022-12 shows neither a level nor a slope change against a pre-period slope (\ItsSeriesCatBlockchainItsChatgptPreSlope{} per359month) that was the steepest of the five categories after federated learning. The self-citation share of blockchain works360fell from \SecFlowBlockchainToBlockchainTwoZeroOneNinePct\,\% in 2019 to \SecFlowBlockchainToBlockchainTwoZeroTwoFivePct\,\% in3612025, with the share of references to cybersecurity rising; co-classification with the LLM category is the lowest of the area362(\SecCoocBlockchainLlmTwoZeroTwoFivePct\,\% in 2025). Established, then: the category grew fastest before 2021 and has grown at363roughly the corpus's pace since, and its highly cited post-2022 works are reviews. Contested: whether smart-contract security364tooling has reduced measured exploit rates since 2020, a question on which the single 2026 landmark, an extension of an365existing detector, offers no evidence (P-H-07). Speculative: every claim about the integration of blockchains with the366metaverse or with artificial intelligence in the 2023--2026 reviews, none of which reports a deployed system.367368\section{Privacy-preserving computation}369\label{sec:sec-privacy}370371\subsection{Composition of the landmark set}372\label{sec:sec-privacy-composition}373374The landmarks of privacy-preserving computation fall into four groups, and the fourth is a classification failure that the375review must report before it can use the other three. The first group is federated learning considered as a privacy376technology, which the ontology makes a child of this category: \citet{yang2019fml}, whose ACM Transactions on Intelligent377Systems and Technology paper introduced the vocabulary of horizontal, vertical and transfer federated learning and is, by37836-month citations, the most cited technical paper of the whole area; SplitFed \citep{thapa2022splitfed}, which combines split379learning and federated learning so that clients hold only part of the model; the 2026 ACM Computing Surveys systematic review380of differentially private federated learning \citep{fu2026dpfl}, whose abstract calls differential privacy ``the de facto381standard for privacy protection in federated learning''; and several federated healthcare applications. The second group is382the 2020 contact-tracing burst: a survey of COVID-19 contact-tracing applications \citep{ahmed2020tracingapps}, the privacy383analysis of TraceTogether \citep[preprint]{cho2020tracing}, a cross-country acceptability survey, a \emph{Nature Medicine}384comment on the responsible use of digital data, an OECD policy note and a German-language chapter on the Corona-Warn-App:385six of twenty-five landmarks from a single year's topic, which the ontology maps to the category at half weight. The third386group is the privacy of models and data: the survey of machine unlearning \citep{nguyen2025unlearning}, framed by the387``right to be forgotten'' and by the observation that deleting data from back-end stores is not sufficient when models388remember; the scoping review of differential privacy in medical deep learning \citep{mohammadi2026dpmedical}; a dissertation389on private information retrieval with side information; and a 2018 paper on privacy-aware mobile service recommendation.390391The fourth group consists of three 2025--2026 papers on artificial intelligence in higher education and one on artificial392intelligence in auditing, published in \emph{Education Sciences}, \emph{Frontiers in Psychology}, \emph{Frontiers in Education}393and the \emph{International Journal of Accounting Information Systems}, each ranked near the top of the category by normalised394citations. Their abstracts mention privacy as one concern among several; the keyword rule of the category fired on the word395in a context that its exclusion list does not veto. Two further records---open-circuit fault diagnosis of power converters396and a federated model for predicting student mental-health risk---are applications whose privacy content is the federated397setting. The principal-investigator review should reclassify the four education and auditing papers; the review does not use398them.399400\subsection{Lineage and evidence}401\label{sec:sec-privacy-lineage}402403The vocabulary that the post-2022 landmarks apply was fixed before the window: differential privacy404\citep{dwork2006dp,dwork2014dp}, its application to stochastic gradient descent \citep{abadi2016dpsgd}, membership inference405\citep{shokri2017membership}, extraction of training data from language models \citep[preprint]{carlini2021extracting} and406web-scale poisoning \citep{carlini2024poisoning}. Among the landmarks only the two 2026 reviews synthesise this vocabulary407with evidence. The medical review \citep{mohammadi2026dpmedical} is the more specific: its abstract reports, over 74 eligible408studies, that differentially private training can maintain clinically acceptable performance under moderate budgets409($\varepsilon \approx 10$), particularly in imaging, while strict budgets ($\varepsilon \approx 1$) often cost substantial accuracy.410That is the review's own summary and is cited as such; it is also the clearest statement in the landmark set of the411utility--privacy trade-off that the category's applied literature tends to assert away (open problem P-H-10).412413The category is the one whose boundary with machine learning moved most during the window. Its self-citation share fell from414\SecFlowPrivacyPreservingComputationToPrivacyPreservingComputationTwoZeroOneNinePct\,\% in 2019 to415\SecFlowPrivacyPreservingComputationToPrivacyPreservingComputationTwoZeroTwoFivePct\,\% in 2025, the lowest of the area,416while references to federated learning rose to \SecFlowPrivacyPreservingComputationToFederatedLearningTwoZeroTwoFivePct\,\%417and references to LLM works reached \SecFlowPrivacyPreservingComputationToLlmTwoZeroTwoSixPct\,\% in 2026. Its works are418co-classified with the LLM category at \SecCoocPrivacyPreservingComputationLlmTwoZeroTwoFivePct\,\% in 2025, the highest rate419of the area, up from \SecCoocPrivacyPreservingComputationLlmTwoZeroTwoTwoPct\,\% in 2022. The category grew throughout the420observation period; its Bai--Perron break is dated \SecBreakPrivacyPreservingComputationBpBreaksBic{} and its PELT change421points \SecBreakPrivacyPreservingComputationPelt{}, the first of which is the contact-tracing year. Established, on this422evidence: differential privacy and federated learning are the two privacy technologies that the applied literature adopts,423and the accuracy cost of strict budgets is documented. Contested: the privacy guarantees of federated learning deployed424without differential privacy or secure aggregation, to which the next section returns. Speculative: the ``privacy by design''425claims of federated healthcare applications that report no attack evaluation.426427\section{Federated learning}428\label{sec:sec-fl}429430\subsection{From averaging to heterogeneity}431\label{sec:sec-fl-heterogeneity}432433The federated-learning landmarks read as the field's own history, and the review follows that order. The pre-window434foundations are in the verified bibliography: federated averaging \citep{mcmahan2017fl}, the collective survey of advances and435open problems \citep{kairouz2021fl}, and the proximal regularisation of FedProx \citep[preprint]{li2018fedprox}. The baseline436landmarks are applications and surveys built on them: federated learning in medicine \citep{sheller2020flmedicine}, whose437abstract presents multi-institutional model training ``without sharing data between institutions'' as the answer to438privacy and ownership obstacles; FedHealth \citep{chen2020fedhealth}, a federated transfer-learning framework for wearables;439the healthcare-informatics review of \citet{xu2021flhealth}; the fairness objective $q$-FFL \citep[preprint]{li2019qffl},440which reweights the aggregate loss toward a more uniform accuracy distribution across devices (the corpus record of the441conference version has no DOI); the survey of \citet{zhang2021flsurvey}, the non-IID survey of \citet{zhu2021noniid}, and442\citet{tan2023personalizedfl}, whose IEEE Transactions on Neural Networks and Learning Systems survey calls federated learning443``the leading paradigm for the training of machine learning models on data silos'' and frames personalisation as the response444to heterogeneity.445446The post-window landmarks make that frame explicit. FedALA \citep{zhang2023fedala} initialises each client's model by an447adaptive local aggregation of the downloaded global model and the local one; FedTGP \citep{zhang2024fedtgp} replaces naive448averaging of class prototypes by trainable global prototypes with an adaptive margin, for clients with heterogeneous models;449FedAS \citep{yang2024fedas} addresses what its abstract calls intra-client and inter-client inconsistency in personalised450federated learning; and the ACM Computing Surveys survey of heterogeneous federated learning \citep{ye2024heterogeneousfl}451organises the problem by the kind of heterogeneity---data, model, network, hardware. A decentralised clustered algorithm452(DFCA, 2026) removes the server altogether. Every one of these abstracts defines its contribution against statistical453heterogeneity, and every one reports superiority over ``state-of-the-art'' baselines on the suite in which it is compared.454That is the established finding and the contested one at once: heterogeneity is the organising problem of the post-2022455literature and personalisation its dominant answer, but no common protocol fixes the levels of heterogeneity at which456methods are compared, and generalisation beyond a method's own suite is not shown (P-H-11).457458\subsection{Robustness, privacy and governance}459\label{sec:sec-fl-privacy}460461Robustness to malicious clients is the second thread. The backdoor attack on federated learning462\citep[preprint]{bagdasaryan2018backdoor} precedes the window; the highly cited 2025 contributions are aggregation rules---a463committee-based Byzantine-resilient scheme \citep{xu2025cbrfl} and a trimmed-mean rule---evaluated on standard benchmarks,464and the 2026 Information Fusion survey \citep{jimenezgutierrez2026flsecurity} separates security-enhancing methods (against465Byzantine, poisoning and Sybil behaviour) from privacy-preserving ones. The privacy thread rests on an attack and two466defences, all pre-window: gradient inversion \citep{zhu2020dlg} showed that model updates leak training data; secure467aggregation \citep{bonawitz2017secagg} and differential privacy \citep{abadi2016dpsgd,fu2026dpfl} are the responses. The468landmark applications in healthcare assert privacy by construction and, judging from their abstracts, evaluate no attack;469the review treats their privacy claims as speculative until such an evaluation is reported (P-H-09). The scoping review of470the governance of federated learning in healthcare \citep{eden2025flgovernance} is explicit that ``limited insights exist on471the optimal governance of this emerging technology'' (P-H-13).472473\subsection{Statistics}474\label{sec:sec-fl-stats}475476Federated learning is the category with the highest baseline growth of the area, from477\SecCountFederatedLearningTwoZeroOneEightMultilabel{} works in 2018 to \SecCountFederatedLearningTwoZeroTwoFiveMultilabel{} in4782025, a \SecRatioMultilabelFederatedLearningSpan-fold increase between 2022 and 2025 alone, and the only one whose interrupted479time series at the reference month shows a negative level and slope change; as Section~\ref{sec:sec-breaks} showed, neither480survives the placebo test, and the category's single Bai--Perron break is dated \SecBreakFederatedLearningBpBreaksBic{}. Its481citation structure changed more than any other in the area. The self-citation share of federated-learning works rose from482\SecFlowFederatedLearningToFederatedLearningTwoZeroOneNinePct\,\% in 2019 to483\SecFlowFederatedLearningToFederatedLearningTwoZeroTwoFivePct\,\% in 2025 as the field acquired a citable literature of its own;484the share of references to privacy-preserving computation rose to485\SecFlowFederatedLearningToPrivacyPreservingComputationTwoZeroTwoFivePct\,\%; and the share to machine-learning theory fell.486Co-classification with the LLM category rose from \SecCoocFederatedLearningLlmTwoZeroTwoTwoPct\,\% in 2022 to487\SecCoocFederatedLearningLlmTwoZeroTwoFivePct\,\% in 2025: federated fine-tuning of foundation models is visible in the labels488but not yet among the landmarks, whose 36-month windows have not closed.489490\section{Convergence, evidence quality and unresolved problems}491\label{sec:sec-synthesis}492493\subsection{What moved and what did not}494\label{sec:sec-synthesis-moved}495496Read together, the five categories support four statements about the area and refute one that is often made about it. No497security category shows a level break at the end of 2022. The volume acceleration of cybersecurity, applied cryptography and498privacy-preserving computation is a slope change that the break detectors date to mid-2022 and to late 2024; blockchain and499federated learning broke upward in early 2020 and decelerated afterwards. The statement that security research was500transformed by the arrival of conversational language models is, on the corpus's evidence, a statement about composition501rather than volume: the share of cybersecurity works co-classified with the LLM category rose several-fold between 2022 and5022025 while the share of their references going to LLM works stayed near one per cent. The security of language-model systems503is a continuation of the security-of-machine-learning literature of 2014--2021 with a new attack surface---instructions in504data, tool use, agent protocols---and its evaluation standards are not settled. Its foundational attack papers are505preprints, and its highly cited peer-reviewed works are surveys.506507Applied cryptography is the area's one dated transition, and it is dated by standards: the third-round report, the two508attacks on finalists, the 2024 FIPS publications and the 2025 fourth-round report. The transition did not move the category's509aggregate volume, which is dominated by encryption-for-devices sub-literatures of contested quality; it moved the reference510flows toward quantum computing only slightly. The fall of SIDH and Rainbow is the area's methodological lesson, and the511standards' wording (``believed to be secure'') is the one the review adopts.512513Convergence is measurable where the ontology predicted it and absent where it did not. Federated learning and514privacy-preserving computation cite each other increasingly (\SecFlowFederatedLearningToPrivacyPreservingComputationTwoZeroTwoFivePct\,\%515of federated-learning references and \SecFlowPrivacyPreservingComputationToFederatedLearningTwoZeroTwoFivePct\,\% of516privacy references in 2025), and both have the area's highest co-classification with the LLM category; the convergence517hypothesis of Part~VIII (Section~\ref{sec:net-flows-categories}) finds its clearest security-side support in this pair.518Blockchain's links to the rest of computer science are weak and its self-citation share, though declining, remains the519highest of the area; its highly cited literature now lives in management and economics venues. Applied cryptography and520cybersecurity remain each other's principal partners, as they were in 2019.521522\subsection{Evidence quality}523\label{sec:sec-synthesis-evidence}524525The review has been explicit about the kinds of evidence behind each statement, and the claims table of the area526(\texttt{literature\_synthesis/agent\_H/claims.csv}) records, for every claim, its type (established, contested, speculative),527its evidence (corpus statistic, abstract, metadata only), the result file or record on which it rests, and a confidence.528Three limits deserve restating. Abstracts are not full texts: every statement about what a landmark paper does rests on its529abstract or title, and the review has not verified any reported result. The landmark metric is a citation metric with the530distortions documented in Section~\ref{sec:sec-landmarks}---duplicates, reprints dated 2026, venue-level records,531misclassifications, a single-topic burst in 2020, and 2026 records ranked on months of citations---so that the composition532of each category's top twenty-five is partly a property of the database (Part~III, Section~\ref{sec:data-quality}) and the533review has, where necessary, said so rather than interpreted it. And the structural-change estimates are descriptive534associations on monthly counts whose last complete month is \ItsLastComplete{}; they are reported with their placebo535distributions and alternative dates, and the review has drawn no causal conclusion from them.536537\subsection{Unresolved problems}538\label{sec:sec-synthesis-problems}539540The problems the review leaves open are listed, with a testable direction for each, in541\texttt{literature\_synthesis/agent\_H/open\_problems.csv} (P-H-01 to P-H-14) and feed Part~X. The most consequential for the542area are five. Whether defences against prompt injection in language-model-integrated applications can be made robust543rather than patched (P-H-01) is unresolved because the attacks arrive as data and no landmark reports a defence with a544guarantee; the testable direction is a preregistered benchmark under adaptive attackers across tool-use protocols. Whether545language-model-based detection improves on fine-tuned encoders at equal cost (P-H-02) is unresolved because the landmark546abstracts report low base accuracy and dataset-specific gains; the direction is cost-matched evaluation with temporal splits.547Whether the standardised lattice schemes will attract the kind of cryptanalysis that broke SIDH and Rainbow (P-H-04), and how548fast post-quantum key exchange is deployed (P-H-05), are questions the corpus can follow in later snapshots by citation549tracking and that Internet measurement can answer directly. Whether personalised federated-learning methods generalise550beyond their own benchmark suites (P-H-11), and whether federated systems deployed without differential privacy or secure551aggregation leak training data under gradient inversion (P-H-09), are questions whose answers require protocols the field has552not yet adopted: shared heterogeneity benchmarks reported per client, and mandatory attack evaluation in application papers.553The last open problem is the review's own: the sensitivity of every area-level landmark statistic to the deduplication of554records that the automatic selection does not perform (P-H-14), which the principal-investigator review can resolve before555Part~IX is finalised.556