1# Agent H — Security, privacy and cryptography: disciplinary synthesis (Phase 5, 2026-11-03)23Area: `security_privacy` (categories `cybersecurity`, `applied_cryptography`, `blockchain`, `privacy_preserving_computation`,4`federated_learning`). Inputs: `literature_synthesis/landmarks/security_privacy_landmarks.csv` (125 works, 25 per category) and5`security_privacy_abstracts.jsonl` (92 abstracts); `results/graph/category_counts_yearly.csv`, `category_flows_yearly.csv`,6`category_cooccurrence_yearly.csv`; `results/bibliometrics/cagr_by_category.csv`; `results/econometrics/breaks.csv` and7`its_results.json` (rows `cat_*`). No knowledge-graph extraction file exists for this area (`data/processed/graph/extraction/` is8empty) and no emerging-topic row concerns these categories, so every statement below rests on metadata, abstracts, or corpus9statistics; nothing rests on a full text. Numbers are quoted here for the record and enter the manuscript only through the10`\Sec...` macros appended to `manuscript/tables/numbers.tex` by `tables/make_numbers.py` and the four tables11`tab_security_counts`, `tab_security_summary`, `tab_security_llm_cooccurrence`, `tab_security_landmarks` (`tables/make_tables.py`).1213## 0. Reading rules and what the inputs can and cannot support1415The landmark set of this area is an automatic selection (`literature_synthesis/select_landmarks.py`): the top works by16field-normalised 36-month citations (NCS36) within each primary category, with 2025–2026 works ranked by 12-month citations17relative to their cohort. Three consequences shape everything that follows. First, the selection is blind to record quality:18duplicated, misdated and misclassified records rank as high as genuine landmarks when OpenAlex attaches citations to them.19Second, the NCS36 criterion favours survey and application papers in categories whose citing community is broad (blockchain,20federated learning), and favours standards and reports in categories where the influential documents are not journal21articles (applied cryptography). Third, 33 of the 125 records are dated 2026 and ranked on a few months of citations; their22normalised scores (up to 9,806 for an SSRN preprint without abstract) measure cohort position, not durable influence. The23synthesis therefore treats the landmark list as a *sample of what is highly cited under the corpus's own metric*, documents24its artefacts explicitly (Section 7), and complements it with the verified references of `manuscript/references.bib` where25the automatic selection missed works that any specialist would consider foundational (NIST FIPS 205, prompt-injection and26jailbreak papers, DP-SGD, secure aggregation). Abstract-level evidence is marked "the abstract reports"; works without27abstract (33 of 125) are discussed from their metadata only.2829## 1. Volume and structural change across the five categories (corpus statistics)3031Counts are eligible works carrying the category (multi-label) per publication year, summed over the pre/baseline/post labels32of `category_counts_yearly.csv`; primary-category counts are reported alongside in `tab_security_counts`. Cybersecurity is the33largest category of the area (78,082 works in 2022; 139,134 in 2025; 829,538 over 2018–2026), applied cryptography the second34(29,699 in 2018; 51,759 in 2025), blockchain (10,872 → 33,426), privacy-preserving computation (11,378 → 49,266) and federated35learning (1,040 → 18,093) follow. Growth profiles differ sharply. Cybersecurity and applied cryptography were nearly flat over362018–2022 (multi-label CAGR 3.7 % and 1.9 %) and accelerated after 2023 (24.7 % and 20.4 % over 2023–2025). Privacy-preserving37computation grew throughout (15.2 % then 39.8 %). Federated learning had the steepest baseline growth of the area (54.3 %) and38remained the fastest-growing category after 2023 (45.8 %), but its growth rate fell. Blockchain is the exception: its growth was39front-loaded (16.7 % baseline, 17.3 % post, with the 2020 Bai–Perron break), and its share of primary classifications peaked40around 2020 (1.76 %) before settling (2.02 % in 2025 on a larger base; `category_share_ci_yearly.csv` places the 2023 share41above the 2025 one when confidence intervals are read).4243The interrupted-time-series estimates at the 2022-12 reference month (`breaks.csv`, HAC p-values) show no level shift for any44of the five categories except federated learning (level −0.126, p = 0.007), and positive slope changes for cybersecurity45(+0.015 per month, p < 0.001), applied cryptography (+0.013), privacy-preserving computation (+0.012) and none for blockchain46(−0.002, p = 0.20) or federated learning (−0.006, p = 0.001, i.e. a deceleration). The placebo distribution over 65 alternative47event months qualifies these: the slope t-statistic at 2022-12 ranks 3rd of 65 for applied cryptography (placebo p = 0.046),484th for cybersecurity (0.062), 9th for privacy-preserving computation (0.138), and is unremarkable for blockchain (0.508) and49federated learning (0.385); the federated-learning level drop is likewise unremarkable against placebos (0.246). Bai–Perron50(BIC) dates a single break at 2022-07 for cybersecurity, applied cryptography and privacy-preserving computation — five months51*before* the reference event — and at 2020-04 (blockchain) and 2020-02 (federated learning). PELT places changes at 2022-1152and 2024-12 for the two security categories, at 2020-12 and 2023-12 for privacy, and at 2020-02 and 2023-05 for federated53learning. The donut specification (three months excluded on each side) turns the cybersecurity and applied-cryptography54level estimates positive and significant (+0.051, p = 0.049; +0.066, p = 0.001) while leaving slopes unchanged, which indicates55that the months around the reference date are themselves unusual (indexing, not necessarily publication). Alternative event56dates tell the same story: the o1 date (2024-10) carries a large positive level coefficient for cybersecurity (+0.149, p = 0.001),57applied cryptography (+0.142) and privacy (+0.198), consistent with a late-2024 acceleration that PELT also detects (2024-12).5859The reading that these results support is modest. The two "security" categories and privacy-preserving computation grew faster60after 2023 than before, the acceleration is dated by the break detectors to mid-2022 and to late 2024 rather than to a single61month, and the growth is partly compositional (Section 6: the share of their works co-classified with the LLM category rose from621.7 % in 2022 to 7.6 % in 2025 for cybersecurity and from 1.4 % to 9.3 % for privacy). Blockchain and federated learning are63stories of the baseline period: both broke upward in early 2020 and neither shows a post-2022 acceleration. None of this is64causal evidence about ChatGPT; the manuscript's structural-change design (Part IV) is explicit that the reference month is a65convention.6667## 2. Cybersecurity6869**What the landmark set contains.** The 25 cybersecurity landmarks are a heterogeneous set: ten are grey literature (five70dissertations, four book chapters, one report), five have no DOI, and nine are dated 2026. The highest-ranked record is a 202671SSRN preprint on persistent homology as a prompt-injection defence (no abstract; NCS36 9,806 on 252 citations within months),72which cannot be assessed from metadata and is flagged for PI review. Two records are misclassified: *Fedformer* (a long-term73time-series forecasting Transformer, reissued as a 2026 CRC chapter) and a 2018 book chapter on *Enigma* (a secure-computation74platform that belongs to privacy-preserving computation). A 2023 IT Professional record titled "IEEE Symposium on Security and75Privacy" (853 citations in 36 months, no abstract) is a venue-level record, not a paper. These artefacts are consistent with the76Part III finding that OpenAlex attaches citations to reprints and container records.7778**Pre-window landmarks.** The genuine baseline landmarks are the adversarial-examples chapter of Kurakin, Goodfellow and Bengio79(a 2018 reprint of the 2017 workshop paper; the abstract reports that adversarial examples survive printing and camera capture,80i.e. transfer to the physical world), the CIC-IDS2017 intrusion-detection dataset paper (no abstract; 534 citations in 36 months,81the single most reused benchmark of the network-intrusion literature), two 2018 IEEE surveys on blockchain for IoT and on the82security and privacy of Bitcoin (both abstracts describe surveys), and a 2018 healthcare-cloud blockchain position paper. The83baseline cybersecurity literature, as sampled by NCS36, was thus dominated by (i) machine-learning-based detection on shared84datasets and (ii) blockchain-as-security-solution surveys — not by the microarchitectural attacks (Spectre, Meltdown) that the85verified reference list records as the field's 2018 landmarks; those are classified in computer architecture or receive their86citations outside the 36-month window.8788**Post-window landmarks and the LLM-security turn.** The post-2023 landmarks with abstracts cluster on large language models89used *for* security and on the security *of* LLM systems. On the first side: *vul-rag* (ACM TOSEM 2026; the abstract reports90that LLMs distinguish vulnerable from patched code with 0.06–0.14 accuracy and that knowledge-level retrieval raises accuracy by9116–24 points), *HuntGPT* (anomaly detection with explainability and an LLM front-end), and a RoBERTa-based phishing detector92(Computer Networks 2026). On the second side: the ACM Computing Surveys survey of security and privacy challenges of LLMs93(jailbreaking, data poisoning, PII leakage; `das2025llmsecurity`), and the ACM TOSEM study of the Model Context Protocol94(a lifecycle of MCP servers in four phases and sixteen activities with a threat taxonomy; `hou2026mcp`). The verified reference95list adds the works that the automatic selection missed because they are preprints or workshop papers: indirect prompt injection96(`greshake2023injection`), prompt-injection attacks on integrated applications (`liu2023promptinjection`, preprint), the97"ignore previous prompt" attack (`perez2022ignore`), the jailbreak analysis of Wei et al. (`wei2023jailbroken`, preprint), the98universal adversarial suffix (`zou2023universal`, preprint), the one-day-exploit agent study (`fang2024oneday`, preprint),99PentestGPT (`deng2023pentestgpt`, preprint) and the surveys of Yao et al. and Shayegani et al. The corpus statistics locate this100turn: works co-classified cybersecurity × LLM rose from 1,337 (2022) to 10,549 (2025) and 14,410 in the incomplete 2026, i.e. from1011.7 % to 7.6 % and 12.0 % of cybersecurity works; co-classification with AI agents reached 5.3 % in 2026. Citation flows show the102same thing more weakly: 0.7 % of references from cybersecurity works went to LLM-category works in 2025 (1.1 % in 2026), against10347.5 % to cybersecurity itself.104105**Assessment.** Established: the security-of-ML literature predates the window (adversarial examples, membership inference,106training-data extraction), and the post-2022 LLM-security literature extends it to a new attack surface (instructions in data,107tool use, agent protocols). Contested: whether LLM-based detection improves on fine-tuned encoders or classical features at equal108cost — the vul-rag abstract itself reports very low base accuracy, and the phishing and HuntGPT abstracts report gains on109specific datasets. Speculative: claims that defences against prompt injection can be made robust; the only landmark on the110question (the 2026 SSRN preprint) argues a negative result and has not been reviewed. The corpus cannot yet tell whether the111LLM-security literature is a durable subfield or a labelling wave; its first 36-month citation windows close in 2026–2027.112113## 3. Applied cryptography114115**Standards as landmarks.** The applied-cryptography landmark set is the clearest case of a category whose most cited documents116are standards and reports rather than papers: RFC 8446 (TLS 1.3, 2018; abstract: "prevent eavesdropping, tampering, and message117forgery"), the NIST status reports on the first (2019) and third (2022) rounds of the post-quantum standardisation process, and118the two 2024 Federal Information Processing Standards FIPS 203 (ML-KEM; the abstract ties its security to Module-LWE and states119that it "is believed to be secure, even against adversaries who possess a quantum computer") and FIPS 204 (ML-DSA, with the same120belief statement for signatures). FIPS 205 (SLH-DSA, hash-based) is not in the landmark set but is in the verified references121(`nist2024fips205`). The 2024 draft transition report (`nist2024transition`) and the fourth-round status report (`nist2025hqc`)122complete the sequence; the latter was not read in full text here and is cited for its existence and date.123124**The timeline the corpus records.** The post-quantum programme is the one development of the area with an unambiguous timeline125inside the observation window: the third-round report (July 2022) announced the selections, two attacks on candidates126appeared in the same year — the key-recovery attack on SIDH of Castryck and Decru (EUROCRYPT 2023; no abstract in the record;127title only) and Beullens's attack on Rainbow ("takes a weekend on a laptop", CRYPTO 2022) — and the final standards were128published in August 2024. The corpus statistics show that this timeline did not translate into an aggregate volume break:129applied cryptography's Bai–Perron break (2022-07) coincides with the NIST announcement month but the category's post-2023130growth (20.4 %) is driven by the much larger encryption-for-IoT and chaos-based image-encryption sub-literatures (see below),131and the flow of references from applied cryptography to quantum computing rose only from 2.8 % (2019) to 4.1 % (2025). The132theoretical base of the lattice standards (Regev's LWE, `regev2009lwe`; Shor's algorithm as the threat model, `shor1997factoring`)133lies outside the corpus window; the 2024–2025 below-threshold error-correction result (`googlequantum2025belowthreshold`) is the134window's main quantum-side event and is classified in quantum computing, not here.135136**What else the landmark set contains.** Three 2025–2026 landmarks are chaos-based or neuron-model image/video encryption137schemes (IEEE TDSC, IEEE TCE, Nonlinear Dynamics) and one is a cryptanalysis of such a scheme (ACM TOMM 2026; the abstract138reports that "many such systems lack standardization and deviate from secure design principles"). This sub-literature is139large in the corpus (OpenAlex topic T11017 is mapped to the category at weight 0.7) and its presence among the most cited1402026 works is a fact about the citing community, not an endorsement; the ontology note records the same reservation. Other141records are artefacts: a 2022 reprint of Diffie–Hellman's 1976 *New Directions* (the "abstract" is the ACM landing page), a1422026 record of TLS 1.3 with the text of an older protocol version, a 2026 ResearchHub copy of the 2010 Scantegrity II paper,143a 2026 Warwick repository record of the 2010 FLINT library, a Reed–Solomon FPGA dissertation, and a 2020 LNCS reprint of *Deep144Leakage from Gradients* (which belongs with federated-learning privacy and is discussed in Section 5). One 2026 Information145Fusion survey on the security and privacy of federated learning (203 papers, per its abstract) is classified here because of its146cryptographic keywords.147148**Assessment.** Established: lattice-based KEM and signature standards exist and are deployed in TLS-style key exchange (the149corpus records the standards; deployment is not in evidence here). Established and important as a methodological lesson:150two of the finalists fell to classical attacks after years of scrutiny, so "post-quantum" denotes a threat model, not a151security proof. Contested within the corpus: the security of the large chaos-based encryption literature, which its own152cryptanalyses dispute. Not addressed by the corpus's landmark metric: homomorphic encryption, zero-knowledge proofs and MPC as153primitives — the verified references (`gentry2009fhe`, `cheon2017ckks`, `chillotti2020tfhe`, `groth2016snark`, `thaler2022proofs`,154`evans2018mpc`) carry this lineage; their post-2022 progeny do not surface in the top-25 because their citing communities are155small and their venues (IACR ePrint, TCHES) are partially mapped.156157## 4. Blockchain systems158159**Shape of the literature.** Blockchain is the category whose landmark set is least about computer science: of 25 works, two160are in the *Review of Financial Studies* (illegal activity financed through bitcoin, estimated at about one quarter of users in161the abstract; blockchain disruption and smart contracts, a theory of decentralised consensus and competition), one in the162*Journal of Institutional Economics* (blockchains as an "institutional technology"), one in *International Journal of163Production Research* (sustainable supply chains), one in *Trends in Food Science & Technology* (agri-food supply chains), one in164*ACM TMIS* (business process management, with seven research directions), one in *Intelligent Systems in Accounting, Finance165and Management* (ontology-driven provenance), plus MIT Press and Springer chapters. The computer-science core is thin but166clear: Hyperledger Fabric (EuroSys 2018; "a modular and extensible open-source system for permissioned blockchains"), the IEEE167Access survey of consensus mechanisms and mining strategy management (2019), the NIST blockchain overview (2018), Guo and Yu's168survey of blockchain security (2022), and — the only 2026 technical landmark — a Datalog-based detector of cross-function169reentrancy over EVM execution traces (FMBC 2026, extending TxSpector). Post-window landmarks are reviews (blockchain for the170metaverse, 2023, 763 citations in 36 months; blockchain in healthcare; two 2024 papers in a journal with 449 citations each that171the PI should examine) and the NFT overview preprint (2021).172173**Artefacts.** The Bitcoin whitepaper appears three times (SSRN records dated 2019, 2022 and 2024 with 7,534, 10,307 and 200174citations in 36 months) plus once as a Springer "recommends" chapter; the 2022 record is the single most cited work of the175whole area under c36. These are the same 2008 document (`nakamoto2008bitcoin` in the verified references), and their citation176counts belong to it. A 2026 SSRN "Global Blockchain Benchmarking Study" record (NCS36 1,481) has no abstract and is likely a177reissue of the 2017 Cambridge study.178179**Corpus statistics.** Blockchain's break is in 2020-04 (Bai–Perron) with PELT changes in 2019-02 and 2022-12; the ITS at1802022-12 shows no level or slope change, and the pre-period slope (+0.015 per month) was the steepest of the five categories181after federated learning. The self-citation share of blockchain works fell from 61.4 % (2019) to 57.2 % (2025) while the share of182references to cybersecurity rose (8.5 % → 9.2 %); co-classification with the LLM category is the lowest of the area (3.1 % in1832025). DeFi, MEV and layer-2 research — present in the verified references through `werner2022defi` — does not reach the top-25 of184a category whose citing community is dominated by application and management journals.185186**Assessment.** Established: the category grew fastest before 2021 and has grown at the corpus's average rate since; its highly187cited post-2022 works are reviews. Contested: whether the smart-contract security literature (reentrancy detection and the like)188constitutes progress beyond the tools of 2018–2020 — the single 2026 landmark reports an extension of an existing framework, and189no landmark reports measured vulnerability rates. Speculative: every claim about blockchain and the metaverse or AI integration190in the 2023–2026 reviews.191192## 5. Privacy-preserving computation193194**Composition.** The category's landmarks split into four groups. (i) Federated learning as privacy technology: Yang et al.'s195*Federated Machine Learning* (ACM TIST 2019; horizontal, vertical and transfer federated learning; 1,382 citations in 36 months,196the most cited technical paper of the area), SplitFed (AAAI 2022; split learning plus federated learning), a 2026 systematic197review of differentially private federated learning (ACM CSUR), hierarchical federated learning with two-stage DP for cloud198anomaly detection (2026) and several federated healthcare applications. (ii) The 2020 contact-tracing burst: a survey of199COVID-19 contact-tracing apps (IEEE Access), the TraceTogether privacy analysis (arXiv preprint), a cross-country acceptability200survey (JMIR), a *Nature Medicine* comment on responsible use of digital data, an OECD policy note and a German-language chapter201on the Corona-Warn-App — six of 25 landmarks from a single year's topic (OpenAlex T12943 is mapped at weight 0.5). (iii)202Privacy of models and data: the survey of machine unlearning (ACM TIST 2025; "the right to be forgotten"), differential privacy203for medical deep learning (npj Digital Medicine 2026; the abstract reports clinically acceptable performance at ε ≈ 10 and204substantial loss at ε ≈ 1), private information retrieval with side information (dissertation), privacy-aware mobile service205recommendation (2018). (iv) Misclassifications: three 2025–2026 papers on artificial intelligence in higher education and one on206AI in auditing (*Education Sciences*, *Frontiers in Psychology*, *Frontiers in Education*, *International Journal of Accounting207Information Systems*), each ranked among the top of the category by NCS36. Their abstracts mention privacy as one concern among208many; the keyword rule of the category fired on "privacy" with an education or auditing qualifier that the exclusion list does209not veto. Two further records (open-circuit fault diagnosis of power converters; mental-health prediction with a federated210CNN–BiLSTM) are applications whose privacy content is the federated setting.211212**Lineage outside the window.** Differential privacy (`dwork2006dp`, `dwork2014dp`), DP-SGD (`abadi2016dpsgd`), membership213inference (`shokri2017membership`), training-data extraction from language models (`carlini2021extracting`, preprint) and214web-scale poisoning (`carlini2024poisoning`) are in the verified references and define the attack and defence vocabulary that215the post-2022 landmarks apply. The 2026 DP-FL review and the medical DP review are the only landmarks that synthesise this216vocabulary; the rest are applications.217218**Corpus statistics.** Privacy-preserving computation grew throughout (15.2 % then 39.8 %) with a Bai–Perron break at 2022-07219and PELT changes at 2020-12 (the contact-tracing year) and 2023-12. Its self-citation share fell from 32.5 % (2019) to 24.4 %220(2025) — the lowest of the area — while references to federated learning (6.1 % in 2025) and LLM works (2.2 % in 2026) rose; its221works are co-classified with LLM at 9.3 % (2025), the highest rate of the area, and with AI safety at a similar rate. The category222is therefore the one whose boundary with machine learning moved most during the window.223224**Assessment.** Established: DP and federated learning are the two privacy technologies that the applied literature adopts, and225the accuracy cost of strict DP budgets is documented by reviews. Contested: the privacy guarantees of federated learning without226DP or secure aggregation (gradient inversion, Section 5 of the federated-learning synthesis). Speculative: the "privacy by227design" claims of federated healthcare applications that report no attack evaluation. Data-quality finding: the category's228NCS36 ranking is contaminated by non-computing papers and by a single-topic burst; the PI review should reclassify the four229education/auditing papers and consider the contact-tracing topic weight.230231## 6. Federated learning232233**From averaging to heterogeneity.** The landmark set reads as the field's own history. Baseline: healthcare applications234(federated learning in medicine, Scientific Reports 2020, multi-institutional collaboration without sharing patient data;235FedHealth, a federated transfer-learning framework for wearables; healthcare informatics review), the fairness objective q-FFL236(ICLR 2020; the corpus record has no DOI and the verified reference is the arXiv preprint), the IoT survey, the KBS survey (no237abstract), the non-IID survey (Neurocomputing 2021), *Towards Personalized Federated Learning* (IEEE TNNLS 2022; "the leading238paradigm for the training of machine learning models on data silos"), and a Hong Kong dissertation on attack-adaptive239aggregation. Post-window: FedALA (AAAI 2023; adaptive local aggregation to initialise personalised models), the ACM CSUR survey240of heterogeneous federated learning (data, model, network and hardware heterogeneity), FedTGP (AAAI 2024; trainable global241prototypes for model-heterogeneous clients), FedAS (CVPR 2024; intra- and inter-client inconsistency in personalised FL), DFCA242(IEEE IoTJ 2026; decentralised clustered FL without a server), committee-based Byzantine-resilient FL (JNCA 2025) and243trimmed-mean aggregation (ESWA 2025), asynchronous FL for SAR imagery (IEEE TMC 2026), a scoping review of governance of FL in244healthcare (npj Digital Medicine 2025), and three 2026 surveys. FedAvg (`mcmahan2017fl`), the 2021 *Advances and Open Problems*245survey (`kairouz2021fl`), FedProx (`li2018fedprox`, preprint), secure aggregation (`bonawitz2017secagg`), the backdoor attack246(`bagdasaryan2018backdoor`, preprint) and gradient leakage (`zhu2020dlg`) are the verified pre-window references that the247post-window landmarks build on.248249**Corpus statistics.** Federated learning is the category with the highest baseline growth (54.3 % CAGR, 1,040 works in 2018 to25018,093 in 2025, a 3.07-fold increase between 2022 and 2025) and the only one whose ITS at 2022-12 shows a negative level and251slope change; neither survives the placebo test (p = 0.246 and 0.385), and Bai–Perron dates the category's single break at2522020-02. The field's citation structure changed more than any other: its self-citation share rose from 10.8 % (2019) to 16.0 %253(2025) as it became citable, references to privacy-preserving computation rose to 15.5 %, and references to ML theory fell from25417.6 % to 13.0 %. Co-classification with LLM rose from 1.5 % (2022) to 7.6 % (2025): federated fine-tuning of foundation models255is visible in the labels but not yet among the landmarks.256257**Assessment.** Established: statistical heterogeneity (non-IID clients) is the organising problem of the post-2022 literature,258and personalisation (local aggregation, prototypes, clustering) its dominant answer; the abstracts of FedALA, FedTGP, FedAS and259DFCA all define their contribution against this problem. Established but under-evaluated in the landmarks: robustness to260malicious clients, where the highly cited 2025 contributions are aggregation rules evaluated on standard benchmarks. Contested:261whether personalised FL methods generalise beyond the benchmark suites in which they are compared (each abstract reports262superiority over "state-of-the-art" baselines on its own suite). Speculative: deployment claims in healthcare, where the 2025263governance review finds that "limited insights exist on the optimal governance" of the technology.264265## 7. Cross-cutting synthesis and data-quality findings2662671. *No security category shows a post-2022 level break.* The volume acceleration of cybersecurity, applied cryptography and268 privacy-preserving computation is a slope change dated by break detectors to mid-2022 and late 2024; blockchain and269 federated learning broke in early 2020 and decelerated after. This is association, not causation.2702. *The LLM turn in security is compositional.* The share of cybersecurity works co-classified with LLM rose roughly fourfold271 between 2022 and 2025; citation flows to LLM works remain small (≤ 1.1 %). The security of LLM systems is a continuation of272 the security-of-ML literature with a new attack surface; its evaluation standards are not yet settled (Section 2).2733. *Standards, not papers, are the landmarks of applied cryptography*, and the post-quantum programme is the area's one274 dated transition; the fall of SIDH and Rainbow is the area's methodological lesson.2754. *Convergence between privacy-preserving computation and federated learning is measurable in flows* (15.5 % of FL references276 to privacy, 6.1 % the other way), while blockchain's links to the rest of computer science are weak and declining in share.2775. *Landmark-set artefacts*: duplicated whitepaper records (Bitcoin ×3, TLS 1.3 ×2), reprints dated 2026 (Scantegrity, FLINT,278 Diffie–Hellman 2022), venue-level records (IEEE S&P 2023), misclassifications (Fedformer; four education/auditing papers;279 Enigma), a single-topic burst (contact tracing 2020), and 2026 records ranked on months of citations. 33 of 125 records have280 no abstract. The PI review (H-3) should remove or merge these before any landmark-level statistic is reported.2816. Unresolved problems are listed in `open_problems.csv` (P-H-01 to P-H-12) and feed Part X.282