1# Agent H — Security, privacy and cryptography: disciplinary synthesis (Phase 5, 2026-11-03)23Area: `security_privacy` (categories `cybersecurity`, `applied_cryptography`, `blockchain`, `privacy_preserving_computation`,4`federated_learning`). Inputs: `literature_synthesis/landmarks/security_privacy_landmarks.csv` (125 works, 25 per category) and5`security_privacy_abstracts.jsonl` (92 abstracts); `results/graph/category_counts_yearly.csv`, `category_flows_yearly.csv`,6`category_cooccurrence_yearly.csv`; `results/bibliometrics/cagr_by_category.csv`; `results/econometrics/breaks.csv` and7`its_results.json` (rows `cat_*`). No knowledge-graph extraction file exists for this area (`data/processed/graph/extraction/` is8empty) and no emerging-topic row concerns these categories, so every statement below rests on metadata, abstracts, or corpus9statistics; nothing rests on a full text. Numbers are quoted here for the record and enter the manuscript only through the10`\Sec...` macros appended to `manuscript/tables/numbers.tex` by `tables/make_numbers.py` and the four tables11`tab_security_counts`, `tab_security_summary`, `tab_security_llm_cooccurrence`, `tab_security_landmarks` (`tables/make_tables.py`).1213## 0. Reading rules and what the inputs can and cannot support1415The landmark set of this area is an automatic selection (`literature_synthesis/select_landmarks.py`): the top works by16field-normalised 36-month citations (NCS36) within each primary category, with 2025–2026 works ranked by 12-month citations17relative to their cohort. Three consequences shape everything that follows. First, the selection is blind to record quality:18duplicated, misdated and misclassified records rank as high as genuine landmarks when OpenAlex attaches citations to them.19Second, the NCS36 criterion favours survey and application papers in categories whose citing community is broad (blockchain,20federated learning), and favours standards and reports in categories where the influential documents are not journal21articles (applied cryptography). Third, 33 of the 125 records are dated 2026 and ranked on a few months of citations; their22normalised scores (up to 9,806 for an SSRN preprint without abstract) measure cohort position, not durable influence. The23synthesis therefore treats the landmark list as a *sample of what is highly cited under the corpus's own metric*, documents24its artefacts explicitly (Section 7), and complements it with the verified references of `manuscript/references.bib` where25the automatic selection missed works that any specialist would consider foundational (NIST FIPS 205, prompt-injection and26jailbreak papers, DP-SGD, secure aggregation). Abstract-level evidence is marked "the abstract reports"; works without27abstract (33 of 125) are discussed from their metadata only.2829## 1. Volume and structural change across the five categories (corpus statistics)3031Counts are eligible works carrying the category (multi-label) per publication year, summed over the pre/baseline/post labels32of `category_counts_yearly.csv`; primary-category counts are reported alongside in `tab_security_counts`. Cybersecurity is the33largest category of the area (78,082 works in 2022; 139,134 in 2025; 829,538 over 2018–2026), applied cryptography the second34(29,699 in 2018; 51,759 in 2025), blockchain (10,872 → 33,426), privacy-preserving computation (11,378 → 49,266) and federated35learning (1,040 → 18,093) follow. Growth profiles differ sharply. Cybersecurity and applied cryptography were nearly flat over362018–2022 (multi-label CAGR 3.7 % and 1.9 %) and accelerated after 2023 (24.7 % and 20.4 % over 2023–2025). Privacy-preserving37computation grew throughout (15.2 % then 39.8 %). Federated learning had the steepest baseline growth of the area (54.3 %) and38remained the fastest-growing category after 2023 (45.8 %), but its growth rate fell. Blockchain is the exception: its growth was39front-loaded (16.7 % baseline, 17.3 % post, with the 2020 Bai–Perron break), and its share of primary classifications peaked40around 2020 (1.76 %) before settling (2.02 % in 2025 on a larger base; `category_share_ci_yearly.csv` places the 2023 share41above the 2025 one when confidence intervals are read).4243The interrupted-time-series estimates at the 2022-12 reference month (`breaks.csv`, HAC p-values) show no level shift for any44of the five categories except federated learning (level −0.126, p = 0.007), and positive slope changes for cybersecurity45(+0.015 per month, p < 0.001), applied cryptography (+0.013), privacy-preserving computation (+0.012) and none for blockchain46(−0.002, p = 0.20) or federated learning (−0.006, p = 0.001, i.e. a deceleration). The placebo distribution over 65 alternative47event months qualifies these: the slope t-statistic at 2022-12 ranks 3rd of 65 for applied cryptography (placebo p = 0.046),484th for cybersecurity (0.062), 9th for privacy-preserving computation (0.138), and is unremarkable for blockchain (0.508) and49federated learning (0.385); the federated-learning level drop is likewise unremarkable against placebos (0.246). Bai–Perron50(BIC) dates a single break at 2022-07 for cybersecurity, applied cryptography and privacy-preserving computation — five months51*before* the reference event — and at 2020-04 (blockchain) and 2020-02 (federated learning). PELT places changes at 2022-1152and 2024-12 for the two security categories, at 2020-12 and 2023-12 for privacy, and at 2020-02 and 2023-05 for federated53learning. The donut specification (three months excluded on each side) turns the cybersecurity and applied-cryptography54level estimates positive and significant (+0.051, p = 0.049; +0.066, p = 0.001) while leaving slopes unchanged, which indicates55that the months around the reference date are themselves unusual (indexing, not necessarily publication). Alternative event56dates tell the same story: the o1 date (2024-10) carries a large positive level coefficient for cybersecurity (+0.149, p = 0.001),57applied cryptography (+0.142) and privacy (+0.198), consistent with a late-2024 acceleration that PELT also detects (2024-12).5859The reading that these results support is modest. The two "security" categories and privacy-preserving computation grew faster60after 2023 than before, the acceleration is dated by the break detectors to mid-2022 and to late 2024 rather than to a single61month, and the growth is partly compositional (Section 6: the share of their works co-classified with the LLM category rose from621.7 % in 2022 to 7.6 % in 2025 for cybersecurity and from 1.4 % to 9.3 % for privacy). Blockchain and federated learning are63stories of the baseline period: both broke upward in early 2020 and neither shows a post-2022 acceleration. None of this is64causal evidence about ChatGPT; the manuscript's structural-change design (Part IV) is explicit that the reference month is a65convention.6667## 2. Cybersecurity6869**What the landmark set contains.** The 25 cybersecurity landmarks are a heterogeneous set: ten are grey literature (five70dissertations, four book chapters, one report), five have no DOI, and nine are dated 2026. The highest-ranked record is a 202671SSRN preprint on persistent homology as a prompt-injection defence (no abstract; NCS36 9,806 on 252 citations within months),72which cannot be assessed from metadata and is flagged for PI review. Two records are misclassified: *Fedformer* (a long-term73time-series forecasting Transformer, reissued as a 2026 CRC chapter) and a 2018 book chapter on *Enigma* (a secure-computation74platform that belongs to privacy-preserving computation). A 2023 IT Professional record titled "IEEE Symposium on Security and75Privacy" (853 citations in 36 months, no abstract) is a venue-level record, not a paper. These artefacts are consistent with the76Part III finding that OpenAlex attaches citations to reprints and container records.7778**Pre-window landmarks.** The genuine baseline landmarks are the adversarial-examples chapter of Kurakin, Goodfellow and Bengio79(a 2018 reprint of the 2017 workshop paper; the abstract reports that adversarial examples survive printing and camera capture,80i.e. transfer to the physical world), the CIC-IDS2017 intrusion-detection dataset paper (no abstract; 534 citations in 36 months,81the single most reused benchmark of the network-intrusion literature), two 2018 IEEE surveys on blockchain for IoT and on the82security and privacy of Bitcoin (both abstracts describe surveys), and a 2018 healthcare-cloud blockchain position paper. The83baseline cybersecurity literature, as sampled by NCS36, was thus dominated by (i) machine-learning-based detection on shared84datasets and (ii) blockchain-as-security-solution surveys — not by the microarchitectural attacks (Spectre, Meltdown) that the85verified reference list records as the field's 2018 landmarks; those are classified in computer architecture or receive their86citations outside the 36-month window.8788**Post-window landmarks and the LLM-security turn.** The post-2023 landmarks with abstracts cluster on large language models89used *for* security and on the security *of* LLM systems. On the first side: *vul-rag* (ACM TOSEM 2026; the abstract reports90that LLMs distinguish vulnerable from patched code with 0.06–0.14 accuracy and that knowledge-level retrieval raises accuracy by9116–24 points), *HuntGPT* (anomaly detection with explainability and an LLM front-end), and a RoBERTa-based phishing detector92(Computer Networks 2026). On the second side: the ACM Computing Surveys survey of security and privacy challenges of LLMs93(jailbreaking, data poisoning, PII leakage; `das2025llmsecurity`), and the ACM TOSEM study of the Model Context Protocol94(a lifecycle of MCP servers in four phases and sixteen activities with a threat taxonomy; `hou2026mcp`). The verified reference95list adds the works that the automatic selection missed because they are preprints or workshop papers: indirect prompt injection96(`greshake2023injection`), prompt-injection attacks on integrated applications (`liu2023promptinjection`, preprint), the97"ignore previous prompt" attack (`perez2022ignore`), the jailbreak analysis of Wei et al. (`wei2023jailbroken`, preprint), the98universal adversarial suffix (`zou2023universal`, preprint), the one-day-exploit agent study (`fang2024oneday`, preprint),99PentestGPT (`deng2023pentestgpt`, preprint) and the surveys of Yao et al. and Shayegani et al. The corpus statistics locate this100turn: works co-classified cybersecurity × LLM rose from 1,337 (2022) to 10,549 (2025) and 14,410 in the incomplete 2026, i.e. from1011.7 % to 7.6 % and 12.0 % of cybersecurity works; co-classification with AI agents reached 5.3 % in 2026. Citation flows show the102same thing more weakly: 0.7 % of references from cybersecurity works went to LLM-category works in 2025 (1.1 % in 2026), against10347.5 % to cybersecurity itself.104105**Assessment.** Established: the security-of-ML literature predates the window (adversarial examples, membership inference,106training-data extraction), and the post-2022 LLM-security literature extends it to a new attack surface (instructions in data,107tool use, agent protocols). Contested: whether LLM-based detection improves on fine-tuned encoders or classical features at equal108cost — the vul-rag abstract itself reports very low base accuracy, and the phishing and HuntGPT abstracts report gains on109specific datasets. Speculative: claims that defences against prompt injection can be made robust; the only landmark on the110question (the 2026 SSRN preprint) argues a negative result and has not been reviewed. The corpus cannot yet tell whether the111LLM-security literature is a durable subfield or a labelling wave; its first 36-month citation windows close in 2026–2027.112