1problem_id,statement,categories,why_unresolved,testable_direction,supporting_keys2P-H-01,Whether defences against prompt injection in LLM-integrated applications can be made robust rather than empirically patched.,cybersecurity;llm;ai_safety,"Attacks are instructions embedded in data or tool outputs; no landmark reports a defence with a formal guarantee, and the only landmark on the question is an unreviewed 2026 preprint reporting a negative result.",Preregistered benchmark of injection attacks across tool-use and agent protocols (e.g. MCP) with defences evaluated under adaptive attackers; report attack success as a function of attacker budget.,greshake2023injection;liu2023promptinjection;hou2026mcp;das2025llmsecurity3P-H-02,Whether LLM-based vulnerability and intrusion detection outperforms fine-tuned encoders or classical features at equal compute and labelling cost.,cybersecurity;software_engineering;llm,Landmark abstracts report low base accuracy and gains from retrieval on specific datasets; no cost-matched comparison appears in the landmark set.,"Cost-matched evaluation on shared datasets (CIC-IDS2017-type benchmarks, vulnerability corpora) with held-out projects and temporal splits.",du2026vulrag;uddin2026phishing;ali2026huntgpt4P-H-03,Durability of the post-2022 LLM-security literature: is it a subfield or a labelling wave?,cybersecurity;llm,Co-classification shares rose fourfold but the first 36-month citation windows of 2023-2024 works close only in 2026-2027.,Re-estimate NCS36 of 2023-2024 cybersecurity x LLM works at the 2027 snapshot; compare with the 2018-2020 adversarial-ML cohort.,das2025llmsecurity;yao2024llmsecurity5P-H-04,Security of the standardised lattice schemes against classical cryptanalysis after the SIDH and Rainbow breaks.,applied_cryptography;computational_complexity,"Two finalists fell to classical attacks after years of scrutiny; standards state belief, not proof, of security.",Track cryptanalytic literature citing FIPS 203/204 and Module-LWE reductions; measure time-to-attack for new candidates (fourth round).,nist2024fips203;nist2024fips204;castryck2023sidh;beullens2022rainbow;regev2009lwe6P-H-05,"Measuring deployment of post-quantum cryptography (TLS, signatures, PKI) rather than publication.",applied_cryptography;computer_networks,"The corpus records standards and reports, not deployment; the transition report sets a timeline that the literature does not yet evaluate.","Internet-measurement studies of PQC negotiation in TLS handshakes and certificate ecosystems, repeated yearly.",nist2024transition;rescorla2018tls137P-H-06,Security of the chaos-based multimedia encryption literature.,applied_cryptography,Highly cited 2025-2026 schemes coexist with cryptanalyses reporting departures from secure design principles; no standard evaluation exists.,Systematic cryptanalysis campaign against the most cited schemes with a shared threat model; publication of negative results.,8P-H-07,Whether smart-contract security tooling has reduced measured vulnerability and exploit rates since 2020.,blockchain;cybersecurity;formal_verification,Landmark on reentrancy extends an existing framework; no landmark reports exploit-rate trends.,Longitudinal measurement of exploits on EVM chains against tool adoption; evaluation of detectors on time-split contract corpora.,guesmi2026reentrancy;werner2022defi9P-H-08,Whether blockchain research has an active computer-science core after 2022 or has migrated to application and management venues.,blockchain,Top-25 landmarks are dominated by reviews and economics; the category's self-citation share is falling and its LLM co-classification is the lowest of the area.,Venue-stratified citation analysis of the category (CS venues vs others) by year; compare with distributed_computing flows.,androulaki2018fabric;wang2019consensus10P-H-09,Privacy guarantees of federated learning without differential privacy or secure aggregation under gradient-inversion attacks.,federated_learning;privacy_preserving_computation,Application landmarks claim privacy by design without attack evaluation; gradient leakage is a documented attack.,"Mandatory attack evaluation (gradient inversion, membership inference) in federated application papers; benchmark of leakage versus model size and batch size.",zhu2020dlg;bonawitz2017secagg;fu2026dpfl;jimenezgutierrez2026flsecurity11P-H-10,Utility cost of strict differential-privacy budgets in medical and tabular settings.,privacy_preserving_computation,"Reviews report acceptable utility at epsilon about 10 and substantial loss at epsilon about 1, with heterogeneity across modalities.",Pre-registered multi-site study with fixed budgets and standard accountants; report utility-privacy curves per modality.,mohammadi2026dpmedical;abadi2016dpsgd;dwork2014dp12P-H-11,Generalisation of personalised federated-learning methods beyond their own benchmark suites.,federated_learning;ml_theory,Each landmark reports superiority over state-of-the-art baselines on its own suite; no common protocol exists for heterogeneity levels.,"Shared benchmark with parameterised heterogeneity (label skew, feature skew, model heterogeneity) and reporting of per-client distributions, not means.",zhang2023fedala;zhang2024fedtgp;yang2024fedas;ye2024heterogeneousfl13P-H-12,Machine unlearning: verifiable deletion from trained models at acceptable cost.,privacy_preserving_computation;llm,Survey landmarks frame the problem (right to be forgotten) but verification of forgetting remains unresolved in the abstracts.,Auditable unlearning benchmarks with membership-inference-based verification and cost accounting; compare exact and approximate methods.,nguyen2025unlearning;shokri2017membership14P-H-13,Governance and accountability of federated learning across institutions and jurisdictions.,federated_learning;privacy_preserving_computation,"The 2025 governance review finds limited insight on optimal governance; deployments are reported as frameworks, not audited systems.","Case studies of operating federations with documented consent, auditing and incident processes; comparison across legal regimes.",eden2025flgovernance;sheller2020flmedicine15P-H-14,"Record-quality effects on landmark identification in security categories (duplicates, reprints, venue records).",cybersecurity;applied_cryptography;blockchain,The automatic NCS36 selection ranks duplicated whitepaper records and 2026 reprints among the top works; the magnitude of the bias on area-level statistics is unknown.,Deduplicate the landmark set by title/DOI family and re-run the selection; report sensitivity of area-level indicators to the merge.,16