1claim_id,claim,claim_type,evidence_type,supporting_keys,contradicting_keys,corpus_artifact,confidence,verification_status,notes2C-H-01,"Cybersecurity is the largest category of the security_privacy area, with 78,082 eligible works carrying the label in 2022 and 139,134 in 2025 (multi-label).",established,corpus_statistic,,,"results/graph/category_counts_yearly.csv (category_id=cybersecurity, n_multilabel summed over periods)",0.95,machine-verified,macros SecCountCybersecurity*Multilabel; 2026 incomplete3C-H-02,Cybersecurity and applied cryptography were nearly flat over 2018-2022 (multi-label CAGR 3.7 % and 1.9 %) and grew faster over 2023-2025 (24.7 % and 20.4 %).,established,corpus_statistic,,,results/graph/category_counts_yearly.csv; macros SecCagrMultilabel*,0.9,machine-verified,CAGR of multi-label counts computed in tables/make_numbers.py (Part VII-b block)4C-H-03,Federated learning had the highest baseline growth of the area (multi-label CAGR 54.3 % over 2018-2022) and remained the fastest-growing category after 2023 (45.8 %) while its growth rate fell.,established,corpus_statistic,,,results/graph/category_counts_yearly.csv; results/bibliometrics/cagr_by_category.csv (federated_learning),0.9,machine-verified,5C-H-04,"Blockchain's growth was front-loaded: Bai-Perron (BIC) dates its single break at 2020-04 and the ITS at 2022-12 shows no level or slope change (slope change -0.002, p=0.200).",established,corpus_statistic,,,results/econometrics/breaks.csv row cat_blockchain; its_results.json series cat_blockchain,0.9,machine-verified,macros ItsSeriesCatBlockchain*6C-H-05,"None of the five security categories shows a significant ITS level shift at 2022-12 except federated learning (level -0.126, p=0.007), and that shift is unremarkable against 65 placebo event months (placebo p=0.246).",established,corpus_statistic,,,results/econometrics/breaks.csv rows cat_*; its_results.json placebo_chatgpt,0.9,machine-verified,7C-H-06,"Cybersecurity, applied cryptography and privacy-preserving computation show positive ITS slope changes at 2022-12 (+0.015, +0.013, +0.012 per month, HAC p<0.001); placebo p-values are 0.062, 0.046 and 0.138 (ranks 4, 3 and 9 of 65).",established,corpus_statistic,,,"results/econometrics/breaks.csv; its_results.json (its_chatgpt, placebo_chatgpt)",0.9,machine-verified,slope change is not a level break; see C-H-078C-H-07,"Bai-Perron dates the single BIC-selected break of cybersecurity, applied cryptography and privacy-preserving computation at 2022-07, five months before the 2022-12 reference month; PELT adds 2024-12 for the two security categories.",established,corpus_statistic,,,"results/econometrics/breaks.csv columns bp_breaks_bic, pelt",0.9,machine-verified,"supports 'mid-2022 and late-2024 acceleration', not a ChatGPT-month break"9C-H-08,"The alternative o1 event date (2024-10) carries large positive level coefficients for cybersecurity (+0.149, p=0.001), applied cryptography (+0.142, p=0.002) and privacy-preserving computation (+0.198, p=0.001).",established,corpus_statistic,,,"results/econometrics/breaks.csv columns o1_level, o1_level_p",0.85,machine-verified,consistent with PELT 2024-12; may reflect indexing of 2025 cohorts10C-H-09,The share of cybersecurity works co-classified with the LLM category rose from 1.7 % (2022) to 7.6 % (2025) and 12.0 % (incomplete 2026); for privacy-preserving computation from 1.4 % to 9.3 % (2025).,established,corpus_statistic,,,results/graph/category_cooccurrence_yearly.csv with category_counts_yearly.csv denominators; tab_security_llm_cooccurrence,0.85,machine-verified,pre-2022 non-zero shares reflect keyword breadth; read the trend11C-H-10,"References from cybersecurity works to LLM-category works remain a small share of their resolved references (0.7 % in 2025, 1.1 % in 2026) against 47.5 % to cybersecurity itself (2025).",established,corpus_statistic,,,results/graph/category_flows_yearly.csv (citing_cat=cybersecurity),0.85,machine-verified,12C-H-11,"The security-of-ML literature predates the window: adversarial examples transfer to the physical world (abstract), membership inference and training-data extraction are pre-2023 results.",established,abstract,kurakin2018physical;szegedy2014intriguing;goodfellow2015fgsm;shokri2017membership;carlini2021extracting,,literature_synthesis/landmarks/security_privacy_abstracts.jsonl (work 2460937040),0.9,human-verified,carlini2021extracting is a preprint record in references.bib13C-H-12,"Post-2022 highly cited cybersecurity works cluster on LLMs used for security tasks (vulnerability detection, anomaly detection, phishing) and on the security of LLM systems (jailbreaks, poisoning, PII leakage, MCP threats).",established,abstract,du2026vulrag;ali2026huntgpt;uddin2026phishing;das2025llmsecurity;hou2026mcp,,"security_privacy_abstracts.jsonl (works 7130652904, 4387210439, 7125967353, 4406302454, 7129030749)",0.8,human-verified,abstracts only14C-H-13,The vul-rag abstract reports that LLMs distinguish vulnerable from similar-but-benign patched code with only 0.06-0.14 accuracy and that knowledge-level retrieval augmentation raises accuracy by 16-24 points.,established,abstract,du2026vulrag,,security_privacy_abstracts.jsonl (work 7130652904),0.85,human-verified,"numbers are the authors' own, from the abstract"15C-H-14,Whether LLM-based security detection improves on fine-tuned encoders or classical features at equal cost is unresolved; landmark abstracts report gains on specific datasets only.,contested,abstract,du2026vulrag;uddin2026phishing;ali2026huntgpt,,security_privacy_abstracts.jsonl,0.6,unverified,no full text read16C-H-15,"Prompt injection (direct and indirect), jailbreaks and universal adversarial suffixes define a new attack surface for LLM-integrated applications; several foundational papers are preprints or workshop papers.",established,metadata_only,greshake2023injection;perez2022ignore;liu2023promptinjection;wei2023jailbroken;zou2023universal;shayegani2023adversarial;yao2024llmsecurity,,manuscript/references.bib (verified keys); not in the landmark set,0.8,machine-verified,preprints described as such in the text17C-H-16,"Claims that prompt-injection defences can be made robust are speculative; the only landmark on the question is a 2026 SSRN preprint reporting a negative result (no abstract, not peer-reviewed).",speculative,metadata_only,,,"security_privacy_landmarks.csv (work 4301785137, NCS36 9,806)",0.5,unverified,flag for PI review18C-H-17,"The most cited documents of applied cryptography in the corpus are standards and reports (RFC 8446; NIST IR 8240, IR 8413; FIPS 203, FIPS 204), not journal or conference papers.",established,metadata_only,rescorla2018tls13;nist2019pqcround1;nist2022pqcround3;nist2024fips203;nist2024fips204,,security_privacy_landmarks.csv (type=report rows of applied_cryptography),0.9,machine-verified,19C-H-18,FIPS 203 (ML-KEM) ties its security to the Module-LWE problem and states that the scheme is believed secure against quantum adversaries; FIPS 204 makes the same statement for ML-DSA signatures.,established,abstract,nist2024fips203;nist2024fips204;regev2009lwe,,"security_privacy_abstracts.jsonl (works 4401459825, 4401442713)",0.9,human-verified,'believed to be secure' is the standard's wording20C-H-19,"Two post-quantum finalists or alternates fell to classical attacks in 2022 (SIDH key recovery; Rainbow broken in a weekend on a laptop), so 'post-quantum' denotes a threat model and not a security proof.",established,metadata_only,castryck2023sidh;beullens2022rainbow,,"security_privacy_landmarks.csv (work 4365934498, no abstract); references_part07b.bib",0.85,machine-verified,titles only; consequences for the NIST process not asserted beyond the dated reports21C-H-20,The post-quantum programme did not produce an aggregate volume break in applied cryptography; the category's post-2023 growth is carried by large IoT-encryption and chaos-based image-encryption sub-literatures.,contested,corpus_statistic,,,"results/graph/category_counts_yearly.csv; taxonomy/ontology.yaml (T11017 weight 0.7); landmarks 4413785573, 7134847443, 7135072016",0.6,unverified,"composition inferred from the landmark sample and the ontology mapping, not from a topic breakdown"22C-H-21,The security of chaos-based multimedia cryptosystems is disputed within the corpus itself: a 2026 cryptanalysis abstract reports that many such systems lack standardisation and deviate from secure design principles.,contested,abstract,,,security_privacy_abstracts.jsonl (work 7154469464),0.7,human-verified,23C-H-22,"Blockchain's highly cited works are predominantly application reviews and economics/management papers; the computer-science core among the landmarks is Hyperledger Fabric, consensus surveys, the NIST overview and smart-contract security.",established,abstract,androulaki2018fabric;wang2019consensus;yaga2018blockchain;guo2022blockchainsecurity;foley2019bitcoin;cong2019smartcontracts;davidson2018institutions;saberi2019supplychain;mendling2018bpm;huynh2023metaverse;guesmi2026reentrancy,,security_privacy_landmarks.csv (primary_category=blockchain),0.85,human-verified,24C-H-23,"The Bitcoin whitepaper appears three times in the landmark set as separate SSRN records (2019, 2022, 2024) with 7,534, 10,307 and 200 36-month citations; the 2022 record is the most cited work of the area under c36.",established,metadata_only,nakamoto2008bitcoin,,"security_privacy_landmarks.csv (works 4248175462, 4211068006, 4405432346)",0.95,machine-verified,data-quality artefact; merge before landmark statistics25C-H-24,Blockchain's self-citation share fell from 61.4 % (2019) to 57.2 % (2025) and its co-classification with LLM is the lowest of the area (3.1 % in 2025).,established,corpus_statistic,,,results/graph/category_flows_yearly.csv; category_cooccurrence_yearly.csv,0.85,machine-verified,26C-H-25,"Federated learning as a privacy technology is the dominant theme of privacy-preserving computation's landmarks; Yang et al. 2019 (horizontal, vertical, transfer FL) is the most cited technical paper of the area (1,382 citations in 36 months).",established,abstract,yang2019fml;thapa2022splitfed;fu2026dpfl,,"security_privacy_landmarks.csv (work 2912213068, c36=1382)",0.9,human-verified,27C-H-26,"Six of the 25 privacy-preserving computation landmarks come from the 2020 COVID-19 contact-tracing topic, a single-year burst that the ontology maps at weight 0.5.",established,metadata_only,ahmed2020tracingapps;cho2020tracing,,"security_privacy_landmarks.csv (works 3036422000, 3014084098, 3013489453, 3021970994, 4205766150, 4286110439); taxonomy/ontology.yaml T12943",0.9,machine-verified,28C-H-27,Four 2025-2026 landmarks of privacy-preserving computation are papers on AI in higher education or auditing with no privacy-technology content; they are keyword misclassifications.,established,abstract,,,"security_privacy_abstracts.jsonl (works 4408302972, 4407111324, 7127055292, 4406636601)",0.9,human-verified,reclassify at PI review29C-H-28,A 2026 scoping review reports that DP-SGD can keep clinically acceptable performance in medical deep learning at moderate budgets (epsilon about 10) while strict budgets (epsilon about 1) often cost substantial accuracy.,established,abstract,mohammadi2026dpmedical;abadi2016dpsgd,,security_privacy_abstracts.jsonl (work 4414891672),0.8,human-verified,the review's own summary; 74 studies per its abstract30C-H-29,"Privacy-preserving computation's self-citation share fell from 32.5 % (2019) to 24.4 % (2025), the lowest of the area, while references to federated learning rose to 6.1 % and co-classification with LLM reached 9.3 % (2025), the highest of the area.",established,corpus_statistic,,,results/graph/category_flows_yearly.csv; category_cooccurrence_yearly.csv,0.85,machine-verified,31C-H-30,"Statistical heterogeneity (non-IID clients) is the organising problem of the post-2022 federated-learning literature and personalisation (adaptive local aggregation, prototypes, clustering) its dominant answer in the landmarks.",established,abstract,tan2023personalizedfl;ye2024heterogeneousfl;zhang2023fedala;zhang2024fedtgp;yang2024fedas;zhu2021noniid,,"security_privacy_abstracts.jsonl (works 3133814152, 4387105517, 4382463479, 4393156671, 4402716118)",0.85,human-verified,32C-H-31,Each personalised-FL landmark abstract reports superiority over state-of-the-art baselines on its own benchmark suite; generalisation beyond those suites is not established.,contested,abstract,zhang2023fedala;zhang2024fedtgp;yang2024fedas,,security_privacy_abstracts.jsonl,0.6,unverified,33C-H-32,"Federated learning's citation structure changed most within the area: self-citation share rose from 10.8 % (2019) to 16.0 % (2025), references to privacy-preserving computation to 15.5 %, and references to ML theory fell from 17.6 % to 13.0 %.",established,corpus_statistic,,,results/graph/category_flows_yearly.csv (citing_cat=federated_learning),0.85,machine-verified,34C-H-33,"Federated learning's co-classification with LLM rose from 1.5 % (2022) to 7.6 % (2025), but federated fine-tuning of foundation models does not appear among its landmarks.",established,corpus_statistic,,,results/graph/category_cooccurrence_yearly.csv; security_privacy_landmarks.csv,0.8,machine-verified,35C-H-34,"Deployment claims of federated healthcare applications are speculative in the landmark abstracts: the 2025 governance review states that limited insights exist on the optimal governance of the technology, and no application landmark reports an attack evaluation.",speculative,abstract,eden2025flgovernance;sheller2020flmedicine;chen2020fedhealth,,"security_privacy_abstracts.jsonl (works 4412162472, 3045674654, 3018464563)",0.6,human-verified,36C-H-35,"The automatic landmark selection of the area contains duplicated, misdated, venue-level and misclassified records (Bitcoin x3, TLS 1.3 x2, 2026 reprints of 2010 papers, 'IEEE Symposium on Security and Privacy' as a work, Fedformer, Enigma); 33 of 125 records are dated 2026 and 33 lack an abstract.",established,metadata_only,,,security_privacy_landmarks.csv; tab_security_landmarks; macros SecLand*,0.95,machine-verified,PI review H-3 should act before landmark-level statistics are reported37C-H-36,"Homomorphic encryption, zero-knowledge proofs and secure multi-party computation do not surface among the applied-cryptography landmarks under the NCS36 metric, although their lineage is in the verified references.",established,metadata_only,gentry2009fhe;cheon2017ckks;chillotti2020tfhe;groth2016snark;thaler2022proofs;evans2018mpc,,"security_privacy_landmarks.csv (no HE/ZK/MPC title among applied_cryptography rows); taxonomy/ontology.yaml (IACR ePrint 0.3 in cybersecurity, 1.0 in applied_cryptography)",0.8,machine-verified,"absence in the top-25 is a statement about the metric and venue mapping, not about the literature's size"38