---
type: protocol
title: Falsification Protocol
n_falsifiers: 13
as_of: 2026-05-08
---

# Falsification Protocol

Each entry below converts a present-tense empirical finding into an actively-watched prediction. If the falsifier triggers, that finding is invalidated and the framework requires update.

The 13 findings consolidate the strongest negative results across **31 deep loops, 22 batch rounds, 165+ parallel agents, 504 unique papers** (synthesis 2026-05-08). The framework is empirically locked: 0 frontier-gate clean crossings, [[bills/bill_06_exact_point_interpolation|Bill 6]] / [[bills/bill_07_cross_frobenius_order|Bill 7]] / [[bills/bill_08_cross_frobenius_linear_complexity|Bill 8]] empty across all 504 papers, no 2024-2026 paper escapes the 13-bill closure pattern.

This document is the *active* form of that closure: every finding has a specific event that would break it.

## How to read an entry

- **Finding** — present-tense statement of the negative result (what is currently true)
- **Falsifier trigger** — the specific event/paper that would invalidate the finding
- **Watchlist source** — where evidence would surface
- **Probability estimate** — low / medium / high, with one-line rationale
- **Impact if triggered** — which bill activates, what the framework must update
- **As-of date** — when last verified

---

## F1 — L_N(1/3) NFS constant 1.923

- **Finding:** The L_N(1/3) constant for the General Number Field Sieve sits at **c = (64/9)^{1/3} ≈ 1.923** and has been unimproved since Coppersmith (1993).
- **Falsifier trigger:** A peer-reviewed paper or eprint posting a balanced-semiprime factoring algorithm with provable (or rigorously heuristic) sub-exponential constant **c < 1.923** in the L_N(1/3) form, with experimental confirmation at ≥150-digit scale.
- **Watchlist source:** arXiv math.NT / cs.CR, IACR eprint, ANTS, Math. Comp., Pascadi smooth-numbers cluster.
- **Probability estimate:** **low** — 33-year unbroken horizon; Pascadi's x^{66/107} smooth-numbers result was the most credible 2025 attempt and it does not threaten c.
- **Impact if triggered:** Activates [[bills/bill_01_two_sided_smoothness|Bill 1]] in a new way; framework must distinguish "constant improvement" from "exponent improvement" and update [[gates/relation_rank|relation_rank gate]] expectations.
- **As-of:** 2026-05-08

## F2 — Boneh-Durfee N^0.292 small-private-exponent bound

- **Finding:** The Boneh-Durfee bound `d < N^0.292` for small-private-exponent RSA cryptanalysis has been **unimproved for 25 years** (since 1999).
- **Falsifier trigger:** A peer-reviewed paper with a Coppersmith-class lattice attack pushing the bound to `d < N^{0.292+ε}` for any concrete ε > 0, verified on RSA-class moduli.
- **Watchlist source:** arXiv cs.CR, IACR eprint, EUROCRYPT, ASIACRYPT, PKC, the Heninger-UCSD / Feng-Nitaj-Pan-Zheng / Hales-DRC clusters.
- **Probability estimate:** **medium** — [[bills/bill_04_reducible_leading_form|Bill 4]] is the hottest research front (66/168 known_bill triggers, 39%); the Ryan multivariate / Lau-Shea exponent-transform / Hales DRC papers all probe the boundary but have not crossed it. Most active falsifier candidate of the 13.
- **Impact if triggered:** [[bills/bill_04_reducible_leading_form|Bill 4]] expansion only — does not threaten balanced semiprimes (lands under [[meta_costs/conditional_polynomial|conditional_polynomial]]). Framework update is local: revise the public-handle threshold inside the small-d regime.
- **As-of:** 2026-05-08

## F3 — Deterministic factoring exponent N^{1/5}

- **Finding:** The unconditional deterministic factoring exponent stands at **N^{1/5}** (Hittmeir / earlier Strassen-Pollard hierarchy), with Umans-Wang arXiv:2511.10851 conjecturally lowering to N^{1/6} only under a number-theoretic hypothesis (NOT GRH). The unconditional bound has not moved.
- **Falsifier trigger:** A peer-reviewed paper proving an **unconditional** deterministic algorithm with worst-case exponent **strictly below 1/5**, or a proof of the Umans-Wang combinatorial-divisibility conjecture promoting their N^{1/6} from conjectural to theorem.
- **Watchlist source:** Math. Comp., Annals, Inventiones, JEMS, arXiv math.NT, ANTS proceedings.
- **Probability estimate:** **low** — Umans-Wang is the strongest single candidate but the conjecture itself is open and Math. Comp. has been clean of factoring 2024-2026 (Hittmeir migrated to Ramanujan Journal).
- **Impact if triggered:** Promotes Umans-Wang to [[meta_costs/engineering_progress|engineering_progress]] → real classical progress. Framework keeps closure but the deterministic floor moves.
- **As-of:** 2026-05-08

## F4 — RSA-250 (829-bit) classical ceiling

- **Finding:** The classical-factoring height ceiling stands at **RSA-250 (829 bits)**, set Feb 2020. **Unbroken for 6+ years.**
- **Falsifier trigger:** A credible classical factorization of any RSA Challenge number ≥ RSA-260 (or any new 850+ bit balanced semiprime) announced via Cado-NFS team, RSA Labs, or equivalent cryptographic announcement.
- **Watchlist source:** rsa-factoring mailing list, NMBRTHRY archive, IACR eprint announcements, CADO-NFS release notes, Heninger lecture slides, Cunningham project bulletins.
- **Probability estimate:** **medium** — engineering progress (BLASter LLL >100x, Cunningham SNFS-336, RSA-150 Buhrow benchmark) is real but no academic team has organized an RSA-260 attempt. Industry-scale classified attempt would surface eventually.
- **Impact if triggered:** Activates [[meta_costs/engineering_progress|engineering_progress]] axis at scale; if achieved without new mathematics, framework holds (closure pattern allows engineering wins). If achieved with novel public-handle, [[gates/relation_rank|relation_rank]] / [[gates/direct_asymmetry|direct_asymmetry]] / [[gates/batch_coverage|batch_coverage]] gates must re-classify the method.
- **As-of:** 2026-05-08

## F5 — ECM 83-digit factor ceiling

- **Finding:** The Elliptic Curve Method (ECM) record stands at **83 digits**, tied Oct 2024 by yoyo@home/Moor. The height has not been advanced since 2013.
- **Falsifier trigger:** A confirmed ECM factor of ≥ 84 digits posted to the GMP-ECM record list or announced via the yoyo@home / BOINC ECM coordinators.
- **Watchlist source:** GMP-ECM record list, mersenneforum.org factoring sub-forum, BOINC project bulletins, ANTS proceedings.
- **Probability estimate:** **medium** — distributed-compute momentum is real (yoyo@home tied the record) and an 84-digit hit is within reach without new mathematics. Tie-not-break in 2024 is the relevant signal.
- **Impact if triggered:** Activates [[bills/bill_03_supply_x_yield|Bill 3]] (supply × yield) extension; height advance does not break framework absent new public-handle, but tightens the supply-side estimate.
- **As-of:** 2026-05-08

## F6 — Bills 6, 7, 8 empty across cataloged literature

- **Finding:** [[bills/bill_06_exact_point_interpolation|Bill 6]] (R0.5 exact-point F(m₁,m₂)=kN, k≠0), [[bills/bill_07_cross_frobenius_order|Bill 7]] (cross-Frobenius order), and [[bills/bill_08_cross_frobenius_linear_complexity|Bill 8]] (cross-Frobenius linear complexity) collectively show **0+1+0 = 1 trigger across 504 cataloged papers**. These are the framework's signature original constructions and the literature has produced no independent paper exercising the same mechanism.
- **Falsifier trigger:** Any peer-reviewed paper or eprint that genuinely triggers Bill 6 or Bill 7 (a non-zero exact-point interpolation construction, or a cross-Frobenius order attack escaping the O(N^{1/4}) birthday ceiling). A second Bill 8 trigger would be a softer signal.
- **Watchlist source:** arXiv math.NT, IACR eprint, ANTS, ASIACRYPT, EUROCRYPT, plus the Pollard-rho cluster (eprint:2025/iteration-maps).
- **Probability estimate:** **low** — these bills define the empty space; an independent re-derivation would itself be a major event. Strongest negative signal in the atlas.
- **Impact if triggered:** Originality claim of [[concepts/atlas_invariant|atlas_invariant]] weakens — framework still holds (closure pattern is bill-completeness, not bill-rarity), but the "one real construction" boxed claim must be revised.
- **As-of:** 2026-05-08

## F7 — LLM factoring ceiling at ~40 digits

- **Finding:** No LLM has factored a balanced semiprime **above 40 digits** without external tools (CADO-NFS, Magma, GP/Pari, etc.). Direct corroboration: Adi Shamir at RSAC 2026 — "There's not been any cryptographic success made by AI."
- **Falsifier trigger:** A reproducible demonstration of any frontier or open-weights LLM factoring a fresh balanced semiprime ≥ 50 digits using only chain-of-thought, with no tool calls to NFS / ECM / Coppersmith libraries. Demonstration must be posted with the prompt and the verified factorization.
- **Watchlist source:** arXiv cs.AI, major AI lab tech reports, RSAC Cryptographers' Panel, evolutionary-search-for-algorithms class papers, NeurIPS, ICLR.
- **Probability estimate:** **low** — algorithmic discovery via LLM evolutionary search (arXiv:2504.05108) is the closest credible vector and it does not approach 40-digit balanced semiprimes; no evidence of capability scaling on this specific task.
- **Impact if triggered:** Activates [[meta_costs/engineering_progress|engineering_progress]] in a new modality; framework holds at the gate level (an LLM attack still has to declare relation-rank / direct-asymmetry / batch-coverage and pass matched controls).
- **As-of:** 2026-05-08

## F8 — No novel-attack patents 2024-2026

- **Finding:** Exhaustive patent searches across **USPTO, WIPO, EPO, JPO, KIPO, CIPA** show **zero novel-attack patents** on classical RSA/integer-factoring algorithms 2024-2026.
- **Falsifier trigger:** A granted or published patent (any of the six offices) claiming a novel classical balanced-semiprime factoring method with non-trivial scope, identified by a credible IP-watch source.
- **Watchlist source:** USPTO PatFT/PAIR, WIPO PatentScope, EPO Espacenet, JPO J-PlatPat, KIPR KIPRIS, CIPA bulletins; Google Patents alerts on G06F-7-72, H04L-9-30, G06N-10 (quantum) intersections.
- **Probability estimate:** **low** — patent silence aligns with senior-cryptographer silence (F11) and zero classified-resource-estimate signal (F12); industry has no incentive to file patents on attacks they do not have.
- **Impact if triggered:** Triggers gate re-classification of the patent's claimed method (relation-rank / direct-asymmetry / batch-coverage); patent text rarely contains enough detail to assess gates, so the watchlist edge here is "patent exists" rather than "method works."
- **As-of:** 2026-05-08

## F9 — ASIACRYPT 2024 + 2025 zero RSA cryptanalysis

- **Finding:** ASIACRYPT 2024 + 2025 collectively published **270 papers with zero RSA cryptanalysis content** — historic first in the conference's history.
- **Falsifier trigger:** Any ASIACRYPT 2026 (or 2027) accepted paper presenting RSA cryptanalysis (Coppersmith-class extensions count as Bill 4, not as breaking the silence — the falsifier requires a paper that the program committee tags as "RSA cryptanalysis" in the session title).
- **Watchlist source:** IACR conference program announcements, ASIACRYPT call-for-papers / accepted-papers lists.
- **Probability estimate:** **medium** — single-conference silence streaks do break statistically; ASIACRYPT 2026 program is the natural test case.
- **Impact if triggered:** No bill activation by itself; restores normal-silence baseline. Framework's "definitive silence" claim weakens to "extended silence."
- **As-of:** 2026-05-08

## F10 — Math. Comp. clean of factoring 2024-2026

- **Finding:** *Mathematics of Computation* has published **zero integer-factoring algorithm papers 2024-2026**. Hittmeir (the journal's primary deterministic-factoring contributor) migrated to *Ramanujan Journal*.
- **Falsifier trigger:** A *Math. Comp.* accepted paper (any 2026-2027 issue) presenting a new classical balanced-semiprime factoring algorithm or a new lower bound directly applicable to the framework.
- **Watchlist source:** Math. Comp. early-view, AMS Notices, MathSciNet, Hittmeir / Pomerance / Lenstra coauthor networks.
- **Probability estimate:** **low** — top-tier number-theory journals (Annals, Inventiones, JEMS, SICOMP, SIDMA, Forum Math Pi/Sigma) are clean except for Pilatte; the migration pattern is structural, not editorial.
- **Impact if triggered:** Topic-level signal only; specific paper would route through the gates and bills as usual.
- **As-of:** 2026-05-08

## F11 — Senior cryptographer silence (30+)

- **Finding:** **30+ senior cryptographers** show zero RSA-factoring publications 2024-2026: Rivest (election security only), Shamir (neural-net cryptanalysis pivot), Coppersmith (classified IDA/CCR pattern), Lenstra brothers (curatorial mode), Pollard, Bach, Williams, Galbraith, Bernstein, Lange, Preneel, Cramer, Biham, Bellare, Krawczyk, Joux (DLP only), Vergnaud, Shparlinski, Enge, Wagstaff, Lyubashevsky, Micciancio (beyond Voronoi), Y. Chen, Steinfeld, Garg, Khurana, Rosen, Kalai, Boyle, Couteau, Stehlé, Hess, Wang, Kilian. Rivest absent from RSAC Cryptographers' Panel 2024/2025/2026.
- **Falsifier trigger:** Any of the named pioneers publishing a 2026-2027 paper on RSA factoring (not on related topics — election security, symmetric crypto, lattices-only, DLP-only do not count).
- **Watchlist source:** DBLP author pages, Google Scholar alerts on the named set, RSAC / CRYPTO / EUROCRYPT / ASIACRYPT panels and keynotes, IACR eprint by-author.
- **Probability estimate:** **low to medium** — Rivest re-entering factoring discourse would be the highest-signal single event; baseline rate at ~1 author/year would be normal noise.
- **Impact if triggered:** Senior re-engagement signal; framework's "structural maturity" interpretation must update. By itself triggers no bill — the published paper would route normally.
- **As-of:** 2026-05-08

## F12 — Government posture reactive

- **Finding:** Government posture is **reactive to open results** (CISA Jan 2026 cites Gidney/Regev quantum estimates; NIST IR 8547 deprecate-2030/disallow-2035 timeline unchanged). Aaronson's predicted "classified resource estimates" signal has **not** materialized.
- **Falsifier trigger:** Any of: (a) NIST advancing the deprecate/disallow timeline ahead of 2030/2035; (b) CISA / NSA Suite B revision citing classical (not quantum) factoring progress; (c) declassified or leaked classified resource estimate showing classical balanced-semiprime progress beyond open literature.
- **Watchlist source:** NIST CSRC publications, CISA advisories, NSA cryptographic guidance, FOIA releases, congressional testimony (House SST, Senate Intelligence), Aaronson's blog (real-time public synthesis).
- **Probability estimate:** **low** — reactive posture is deeply structural; quantum timeline acceleration (Pinnacle/Cain/Babbush-Boneh) has not yet moved NIST's classical RSA deprecation schedule.
- **Impact if triggered:** Most consequential of the 13. Activates a framework-level update: "no public handle" claim weakens to "no open public handle." Bills remain valid as a public-knowledge framework, but the closure claim becomes one-sided.
- **As-of:** 2026-05-08

## F13 — Frontier-gate clean crossings: zero

- **Finding:** Across **504 cataloged papers**, **zero papers** cross all three frontier gates ([[gates/relation_rank|relation_rank]], [[gates/direct_asymmetry|direct_asymmetry]], [[gates/batch_coverage|batch_coverage]]) cleanly without falling under a known bill or meta-cost. This is the framework's master closure statistic.
- **Falsifier trigger:** A **single** paper that the classifier (v1.15+) routes to verdict `gate_claim_probe_worthy_if_verified` AND survives matched-control verification on its claimed gate AND does not retroactively activate a known bill.
- **Watchlist source:** All sources combined — arXiv math.NT / cs.CR, IACR eprint, ANTS / CRYPTO / EUROCRYPT / ASIACRYPT / PKC proceedings, *Math. Comp.*, top-tier number theory journals. Synthesis-loop cadence is the operational watchlist.
- **Probability estimate:** **low** — this is the integrated falsifier; if any of F1-F12 fire with a real public-handle attached, F13 fires automatically. Independent F13 trigger (gate-crossing without underlying bill activation) would be the cleanest possible falsification of [[concepts/atlas_invariant|atlas_invariant]].
- **Impact if triggered:** Framework requires comprehensive update. The "13-bill closure" claim is empirically refuted; the new method becomes the seed of a 14th bill or a re-classification of an existing one. Highest-impact entry in this document.
- **As-of:** 2026-05-08

---

## Live alerts — 5 highest-probability falsifiers

Priority watchlist (probability × signal-clarity × actionability):

1. **[[#F2 — Boneh-Durfee N^0.292 small-private-exponent bound|F2 — Boneh-Durfee N^0.292]]** — most active research front ([[bills/bill_04_reducible_leading_form|Bill 4]], 66 triggers); **medium** probability; Heninger-UCSD / Feng-Nitaj-Pan-Zheng / Hales-DRC clusters are all probing the boundary. **Watch:** EUROCRYPT 2026/2027, ASIACRYPT 2026, PKC 2026/2027, IACR eprint cs.CR daily.
2. **[[#F4 — RSA-250 (829-bit) classical ceiling|F4 — RSA-250 ceiling]]** — engineering momentum is real (BLASter LLL >100x, Cunningham SNFS-336); **medium** probability; an academic RSA-260 attempt could surface in 2026-2027. **Watch:** rsa-factoring mailing list, NMBRTHRY, CADO-NFS release notes, Heninger group bulletins.
3. **[[#F5 — ECM 83-digit factor ceiling|F5 — ECM 83-digit ceiling]]** — yoyo@home/Moor *tied* the 83-digit record Oct 2024; an 84-digit hit is within reach of distributed compute. **Medium** probability. **Watch:** GMP-ECM record list, mersenneforum.org factoring sub-forum, BOINC project bulletins.
4. **[[#F9 — ASIACRYPT 2024 + 2025 zero RSA cryptanalysis|F9 — ASIACRYPT silence]]** — single-conference silence streaks do break; **medium** probability; ASIACRYPT 2026 program is the natural test. **Watch:** IACR conference accepted-papers announcements (typically Aug-Sept).
5. **[[#F11 — Senior cryptographer silence (30+)|F11 — Senior silence]]** — Rivest re-engaging would be the highest-signal single event in the entire watchlist; **low to medium** probability per author per year, integrated over 30+ authors becomes non-negligible. **Watch:** DBLP author pages on the named set, RSAC Cryptographers' Panel program, IACR eprint by-author.

The 8 lower-probability falsifiers (F1, F3, F6, F7, F8, F10, F12, F13) remain on passive watch; they would each constitute a major event but lack a current near-term signal.

## See also

- [[concepts/atlas_invariant]] — central proposition the falsifiers operationalize
- [[bills/bill_04_reducible_leading_form|Bill 4]] | [[bills/bill_06_exact_point_interpolation|Bill 6]] | [[bills/bill_07_cross_frobenius_order|Bill 7]] | [[bills/bill_08_cross_frobenius_linear_complexity|Bill 8]]
- [[gates/relation_rank]] | [[gates/direct_asymmetry]] | [[gates/batch_coverage]]
- [[meta_costs/engineering_progress]] | [[meta_costs/non_classical_oracle]] | [[meta_costs/conditional_polynomial]]