# Agent H — Security, privacy and cryptography: disciplinary synthesis (Phase 5, 2026-11-03)

Area: security_privacy (categories cybersecurity, applied_cryptography, blockchain, privacy_preserving_computation, federated_learning). Inputs: literature_synthesis/landmarks/security_privacy_landmarks.csv (125 works, 25 per category) and security_privacy_abstracts.jsonl (92 abstracts); results/graph/category_counts_yearly.csv, category_flows_yearly.csv, category_cooccurrence_yearly.csv; results/bibliometrics/cagr_by_category.csv; results/econometrics/breaks.csv and its_results.json (rows cat_*). No knowledge-graph extraction file exists for this area (data/processed/graph/extraction/ is empty) and no emerging-topic row concerns these categories, so every statement below rests on metadata, abstracts, or corpus statistics; nothing rests on a full text. Numbers are quoted here for the record and enter the manuscript only through the \Sec... macros appended to manuscript/tables/numbers.tex by tables/make_numbers.py and the four tables tab_security_counts, tab_security_summary, tab_security_llm_cooccurrence, tab_security_landmarks (tables/make_tables.py).

# 0. Reading rules and what the inputs can and cannot support

The landmark set of this area is an automatic selection (literature_synthesis/select_landmarks.py): the top works by field-normalised 36-month citations (NCS36) within each primary category, with 2025–2026 works ranked by 12-month citations relative to their cohort. Three consequences shape everything that follows. First, the selection is blind to record quality: duplicated, misdated and misclassified records rank as high as genuine landmarks when OpenAlex attaches citations to them. Second, the NCS36 criterion favours survey and application papers in categories whose citing community is broad (blockchain, federated learning), and favours standards and reports in categories where the influential documents are not journal articles (applied cryptography). Third, 33 of the 125 records are dated 2026 and ranked on a few months of citations; their normalised scores (up to 9,806 for an SSRN preprint without abstract) measure cohort position, not durable influence. The synthesis therefore treats the landmark list as a sample of what is highly cited under the corpus's own metric, documents its artefacts explicitly (Section 7), and complements it with the verified references of manuscript/references.bib where the automatic selection missed works that any specialist would consider foundational (NIST FIPS 205, prompt-injection and jailbreak papers, DP-SGD, secure aggregation). Abstract-level evidence is marked "the abstract reports"; works without abstract (33 of 125) are discussed from their metadata only.

# 1. Volume and structural change across the five categories (corpus statistics)

Counts are eligible works carrying the category (multi-label) per publication year, summed over the pre/baseline/post labels of category_counts_yearly.csv; primary-category counts are reported alongside in tab_security_counts. Cybersecurity is the largest category of the area (78,082 works in 2022; 139,134 in 2025; 829,538 over 2018–2026), applied cryptography the second (29,699 in 2018; 51,759 in 2025), blockchain (10,872 → 33,426), privacy-preserving computation (11,378 → 49,266) and federated learning (1,040 → 18,093) follow. Growth profiles differ sharply. Cybersecurity and applied cryptography were nearly flat over 2018–2022 (multi-label CAGR 3.7 % and 1.9 %) and accelerated after 2023 (24.7 % and 20.4 % over 2023–2025). Privacy-preserving computation grew throughout (15.2 % then 39.8 %). Federated learning had the steepest baseline growth of the area (54.3 %) and remained the fastest-growing category after 2023 (45.8 %), but its growth rate fell. Blockchain is the exception: its growth was front-loaded (16.7 % baseline, 17.3 % post, with the 2020 Bai–Perron break), and its share of primary classifications peaked around 2020 (1.76 %) before settling (2.02 % in 2025 on a larger base; category_share_ci_yearly.csv places the 2023 share above the 2025 one when confidence intervals are read).

The interrupted-time-series estimates at the 2022-12 reference month (breaks.csv, HAC p-values) show no level shift for any of the five categories except federated learning (level −0.126, p = 0.007), and positive slope changes for cybersecurity (+0.015 per month, p < 0.001), applied cryptography (+0.013), privacy-preserving computation (+0.012) and none for blockchain (−0.002, p = 0.20) or federated learning (−0.006, p = 0.001, i.e. a deceleration). The placebo distribution over 65 alternative event months qualifies these: the slope t-statistic at 2022-12 ranks 3rd of 65 for applied cryptography (placebo p = 0.046), 4th for cybersecurity (0.062), 9th for privacy-preserving computation (0.138), and is unremarkable for blockchain (0.508) and federated learning (0.385); the federated-learning level drop is likewise unremarkable against placebos (0.246). Bai–Perron (BIC) dates a single break at 2022-07 for cybersecurity, applied cryptography and privacy-preserving computation — five months before the reference event — and at 2020-04 (blockchain) and 2020-02 (federated learning). PELT places changes at 2022-11 and 2024-12 for the two security categories, at 2020-12 and 2023-12 for privacy, and at 2020-02 and 2023-05 for federated learning. The donut specification (three months excluded on each side) turns the cybersecurity and applied-cryptography level estimates positive and significant (+0.051, p = 0.049; +0.066, p = 0.001) while leaving slopes unchanged, which indicates that the months around the reference date are themselves unusual (indexing, not necessarily publication). Alternative event dates tell the same story: the o1 date (2024-10) carries a large positive level coefficient for cybersecurity (+0.149, p = 0.001), applied cryptography (+0.142) and privacy (+0.198), consistent with a late-2024 acceleration that PELT also detects (2024-12).

The reading that these results support is modest. The two "security" categories and privacy-preserving computation grew faster after 2023 than before, the acceleration is dated by the break detectors to mid-2022 and to late 2024 rather than to a single month, and the growth is partly compositional (Section 6: the share of their works co-classified with the LLM category rose from 1.7 % in 2022 to 7.6 % in 2025 for cybersecurity and from 1.4 % to 9.3 % for privacy). Blockchain and federated learning are stories of the baseline period: both broke upward in early 2020 and neither shows a post-2022 acceleration. None of this is causal evidence about ChatGPT; the manuscript's structural-change design (Part IV) is explicit that the reference month is a convention.

# 2. Cybersecurity

What the landmark set contains. The 25 cybersecurity landmarks are a heterogeneous set: ten are grey literature (five dissertations, four book chapters, one report), five have no DOI, and nine are dated 2026. The highest-ranked record is a 2026 SSRN preprint on persistent homology as a prompt-injection defence (no abstract; NCS36 9,806 on 252 citations within months), which cannot be assessed from metadata and is flagged for PI review. Two records are misclassified: Fedformer (a long-term time-series forecasting Transformer, reissued as a 2026 CRC chapter) and a 2018 book chapter on Enigma (a secure-computation platform that belongs to privacy-preserving computation). A 2023 IT Professional record titled "IEEE Symposium on Security and Privacy" (853 citations in 36 months, no abstract) is a venue-level record, not a paper. These artefacts are consistent with the Part III finding that OpenAlex attaches citations to reprints and container records.

Pre-window landmarks. The genuine baseline landmarks are the adversarial-examples chapter of Kurakin, Goodfellow and Bengio (a 2018 reprint of the 2017 workshop paper; the abstract reports that adversarial examples survive printing and camera capture, i.e. transfer to the physical world), the CIC-IDS2017 intrusion-detection dataset paper (no abstract; 534 citations in 36 months, the single most reused benchmark of the network-intrusion literature), two 2018 IEEE surveys on blockchain for IoT and on the security and privacy of Bitcoin (both abstracts describe surveys), and a 2018 healthcare-cloud blockchain position paper. The baseline cybersecurity literature, as sampled by NCS36, was thus dominated by (i) machine-learning-based detection on shared datasets and (ii) blockchain-as-security-solution surveys — not by the microarchitectural attacks (Spectre, Meltdown) that the verified reference list records as the field's 2018 landmarks; those are classified in computer architecture or receive their citations outside the 36-month window.

Post-window landmarks and the LLM-security turn. The post-2023 landmarks with abstracts cluster on large language models used for security and on the security of LLM systems. On the first side: vul-rag (ACM TOSEM 2026; the abstract reports that LLMs distinguish vulnerable from patched code with 0.06–0.14 accuracy and that knowledge-level retrieval raises accuracy by 16–24 points), HuntGPT (anomaly detection with explainability and an LLM front-end), and a RoBERTa-based phishing detector (Computer Networks 2026). On the second side: the ACM Computing Surveys survey of security and privacy challenges of LLMs (jailbreaking, data poisoning, PII leakage; das2025llmsecurity), and the ACM TOSEM study of the Model Context Protocol (a lifecycle of MCP servers in four phases and sixteen activities with a threat taxonomy; hou2026mcp). The verified reference list adds the works that the automatic selection missed because they are preprints or workshop papers: indirect prompt injection (greshake2023injection), prompt-injection attacks on integrated applications (liu2023promptinjection, preprint), the "ignore previous prompt" attack (perez2022ignore), the jailbreak analysis of Wei et al. (wei2023jailbroken, preprint), the universal adversarial suffix (zou2023universal, preprint), the one-day-exploit agent study (fang2024oneday, preprint), PentestGPT (deng2023pentestgpt, preprint) and the surveys of Yao et al. and Shayegani et al. The corpus statistics locate this turn: works co-classified cybersecurity × LLM rose from 1,337 (2022) to 10,549 (2025) and 14,410 in the incomplete 2026, i.e. from 1.7 % to 7.6 % and 12.0 % of cybersecurity works; co-classification with AI agents reached 5.3 % in 2026. Citation flows show the same thing more weakly: 0.7 % of references from cybersecurity works went to LLM-category works in 2025 (1.1 % in 2026), against 47.5 % to cybersecurity itself.

Assessment. Established: the security-of-ML literature predates the window (adversarial examples, membership inference, training-data extraction), and the post-2022 LLM-security literature extends it to a new attack surface (instructions in data, tool use, agent protocols). Contested: whether LLM-based detection improves on fine-tuned encoders or classical features at equal cost — the vul-rag abstract itself reports very low base accuracy, and the phishing and HuntGPT abstracts report gains on specific datasets. Speculative: claims that defences against prompt injection can be made robust; the only landmark on the question (the 2026 SSRN preprint) argues a negative result and has not been reviewed. The corpus cannot yet tell whether the LLM-security literature is a durable subfield or a labelling wave; its first 36-month citation windows close in 2026–2027.