Part X
The assurance ledger
Epistemic status, stated first rather than last. This episode is a structural argument about a mechanism. It is not a documented campaign, and I am not asserting that anyone is executing it. The individual claims — that primitive assurance is attention-dependent, that the qualified analyst pool for some assumption families is small, that cryptanalysis is more automatable than security proof — are each defensible on their own. The composition of them into a single exposure is an inference. I am publishing it because the measurements that would settle it are cheap, public, and unrun, and because an exposure that nobody has named cannot be managed.
I am putting that paragraph at the top because in an earlier draft it was at the bottom, after the argument, and episode nine is about exactly what happens to a qualifier that arrives downstream of the claim it qualifies.
The thing we do not say out loud
Assurance is a quantity, not a theorem
Ask why you trust AES.
The honest answer is not "because it has been proven secure." No deployed symmetric primitive has been proven secure in any absolute sense, and no one working in the field thinks otherwise. The honest answer is:
A large number of highly qualified people attacked it, in public, for a long time, and failed.
That is the actual basis. It is a good basis — it is arguably the only basis available for the primitives we depend on — but it is worth noticing what kind of thing it is. It is not a mathematical fact about the construction. It is an empirical fact about how much expert attention has been spent trying to break it and how that attention was distributed.
Which means primitive assurance is a quantity. Something closer to P(no successful attack | N expert-years of public cryptanalysis) than to a theorem. The structured competitions — AES, SHA-3, the post-quantum process — are the mechanism by which we accumulate that quantity, and the competition records are, in effect, the receipts.
And here is the thing about quantities that is not true about theorems. Theorems do not decay. Quantities can go down.
The ledger
Two columns, moving independently
Split the quantity into the two terms that actually determine it.
The defender-side term
Public expert-years spent analysing primitives and the mathematical assumption families beneath them — lattice problems, isogenies, code-based assumptions. It is produced by a specific, small, identifiable population: academic researchers, government analysts, and a modest number of industry cryptographers, funded by academic and government support for foundational mathematics.
The attacker-side term
Effective analysis capacity applied to breaking the same constructions. It is not fully observable and it never has been.
Assurance depends on the relationship between them. And these two terms are driven by completely different processes: the first by funding structures, graduate pipelines, and what a research community considers a worthwhile problem; the second by capability and incentive.
Now bring forward the asymmetry from episode two. Cryptanalysis is existential search with a mechanically checkable success condition. Does the distinguisher work? Does the attack recover the key? That is &exists;-shaped, self-verifying, and — in the vocabulary of episode three — highly grindable. Security argument is ∀-shaped over a model, has no cheap oracle, and does not accelerate the same way.
So automated capability does not lift both columns equally. It lifts the column that is &exists;-shaped and grindable, and leaves most of the other column where it was.
The exposure
What is structurally unprotected here
Set aside adversaries entirely for a moment and just look at the system.
We depend on a quantity. The quantity is produced by a small population doing work whose applied value is genuinely hard to evidence in the short term. The funding for that population is justified by claims about long-horizon downstream value — trust us, this pure mathematics will matter — which is precisely the class of claim that is weakly supported by the evidence available today.
And there is a real, good-faith scientific debate to be had about whether that funding produces the value claimed for it. That debate is legitimate. Automated research capability makes it more tractable, because it raises the statistical power available for exactly the kind of retrospective study that could answer it: how much foundational mathematical output actually reaches application, over what lag, in which subfields.
Here is the structural point, and it does not require anybody to be acting in bad faith:
A well-conducted study of that question will produce differential results by subfield. Some areas will show transfer. Others will not. And the subfields underwriting cryptographic assumptions are, by any citation-distance measure, among the least application-adjacent in mathematics. A differential result licenses selective reallocation with an evidentiary basis, and the natural targets of a good-faith reallocation include the fields that produce the defender-side column.
There is no control anywhere in that chain. No unauthorized access, no falsified claim, no policy violation, no identifiable adversarial act. Every step is a legitimate contribution to a real debate. And expertise pools respond to funding with a lag of roughly a doctoral generation, which means by the time the effect is measurable it is already irreversible on the timescale that matters for a primitive migration.
The historical case study for what insufficient or misdirected scrutiny produces is the Dual_EC standardization episode, and it is worth studying precisely because the failure there was not mathematical. The mathematics was available. The scrutiny was not distributed where it needed to be.
The same structure threatens safety-assurance expertise more broadly, for what it is worth: the pool qualified to assess autonomy safety cases is small, its funding rests on accident-prevention claims that are hard to evidence, and a well-argued deflationary case about it would shrink that pool by the identical mechanism.
What would settle it
Three measurements, all archival, all public
This is where the episode earns its place, because the inference above is testable and the tests are cheap.
Expert-years per primitive
From competition records. The AES, SHA-3, and post-quantum processes are documented in public. Participation, submissions, published analyses, teams involved. Extract them. This produces, for the first time, a defensible number for how much accumulated attention a deployed primitive actually rests on.
Assessor pool size
By assumption family, across eras. Enumerate the analysts qualified to attack lattice-based and code-based assumptions by publication record, and compare to the pool that attacked symmetric primitives during the AES process. If that number is materially smaller, it is the single most consequential figure in this entire season, and it should be reported prominently.
Citation-distance baselines
By mathematical subfield. The instrument for the retrospective study, and the thing that determines whether "differential by subfield" is a real prediction or a rhetorical one. Runnable on public bibliometric data today.
None of these require model access, ethics review, or anyone's cooperation. All three are archival work on public records. The reason to want them is not to win an argument — it is that a quantity we depend on has never been measured, and until it is, everyone discussing it is reasoning from vibes, including me.
Monday
For the people who can actually act on this
Ask what your portfolio's cryptographic-assurance exposure is before reallocating away from foundational mathematics. Not as a veto — as a line item that currently does not exist in any portfolio review I have seen.
The assurance basis for your target primitives is an accumulated quantity, and you can ask how large it is. "Has been through a standardization process" is a proxy. The competition record is the data.
Add a row. Most threat models treat primitive strength as a constant. It is a function of a number that nobody in the model is tracking, and the number is not guaranteed to be monotonic.
The three measurements above are how to demonstrate it, and I would genuinely rather see them run and come back reassuring than have this sit as an unfalsified worry.
Next episode turns the season's instruments on the research that produced it, including the parts that did not survive.
