M12-v5 — independent strict review, 22 October 2026

Judgments
Validity: supported internally; no proof gap or refutation found.
Original coverage: complete original for the EXACT UNIFORM ACCEPTED matrix
ensemble of campaign/originals/M12.tex:6–26 and nonempty admissible dimensions.
It is not a theorem about the source's sequential sampler, a modified sparse
construction, all parameter regimes, or the security of all IQP verification.
Source comparison: difference supported in the bounded current primary-source
comparison. The attack itself and its block normal form are known. No specific
unresolved covering theorem blocks the conditioned success result.
External status: no external expert acceptance established; no dissemination
action was taken in this review.

Independent proof audit
The complete proof.txt and accepted-law.txt were read before earlier verdicts.
All inputs and manuscript hashes are in frozen-inputs.json.
1. accepted-law.txt:2–18: F^T F invertible and D independent imply T=(F|D)
has independent columns. Hence H has full column rank iff C does. Given C,
the lower quotient has dimension h=d-w. If Tu=1 has a solution it is unique
and nonzero. A uniform quotient matrix kills u with probability exactly
2^-h, independent of upper T and full-rank C. Lifts all have equal counts.
This is the necessary acceptance-bias calculation, not an independence guess.
2. accepted-law.txt:20–37 and proof.txt:8–19: f!=0 leaves Bbar unrestricted;
f=0 forces Bbar b=0 and the radical image contains Db=1 whenever Bbar has
full row rank. Left-null-vector union bounds give failure <2^(1-w). In the
other branch the uniform w-subspace kernel misses a nonzero row functional
with probability <=2^-w. Conditioning on full rank does not introduce a
dependence on D, because the full-rank probability is constant in that branch.
3. proof.txt:21–41: for 1 not in D, Dperp/D is a nondegenerate nonalternating
bilinear space with canonical vector 1+D. Such spaces over F2 are classified
by dimension; their isometries preserve the canonical vector. Thus the
number of nondegenerate g-subspaces containing it, ordered bases, and 2^(dg)
lifts is constant over the relevant doubly-even D. This establishes the
uniform code law after upper and lower acceptance. A zero-weight branch is
excluded rather than divided by.
4. proof.txt:43–86 and 111–140: the quadratic form wt(x)/2 on the even
hyperplane must be handled separately for odd m, m=0 mod4 (singular all-ones
radical), and m=2 mod4 (nonsingular radical). The displayed counts and lift
multiplicities are consistent with these three cases. The factorizations at
111–125 explicitly telescope the shortening ratios; all are <=2*2^-d for
the sufficiently large admissible dimensions. Missing a coordinate is exactly
shortening to length m-1. This gives the missing full-support bound without
assuming independent code coordinates.
5. proof.txt:88–103: once Bbar has full row rank, column elimination removes
A and identifies H ker(H^T H)=(D ker Bbar,0). The equality ker(R^T R)=ker R
uses injectivity of R^T for full-row-rank R over F2; it does not rely on a
false positive-definiteness argument in characteristic two. Full support
then yields the unique secret, and row/column obfuscation preserves success.
The final failure bound is 2m1*2^-d + m1*2^-w + 2^(1-w), tending to zero in
the exact original asymptotic regime.

Primary-source comparison
• Gross–Hangleiter, 2312.10156v2, Algorithm 1, Corollary 3, §4.1.3, Eq. (14)
and its qualification: the radical attack, normal form and empirical success
are inherited. The constrained code full-support step is left unresolved;
an approximate product formula is not the exact accepted-law estimate proved
here. https://arxiv.org/html/2312.10156v2
• Bremner–Cheng–Ji, 2308.07152v2 / PRX Quantum 6, 020315 (2025), §VI.4
and Appendix H: the modified construction uses parameter constraints and
sparse blocks to defeat known attacks. In particular the radical-avoidance
condition m2>=n-g implies w<=0, incompatible with this theorem's growing
positive w regime. The altered sampling law is not the uniform accepted law.
It therefore neither supplies this success bound nor contradicts it.
https://arxiv.org/html/2308.07152v2
https://doi.org/10.1103/PRXQuantum.6.020315
• 2603.09901's planted-secret discussion is contextual, not an exact
conditioned-code theorem. No such theorem was located in the current searches.
https://arxiv.org/abs/2603.09901

Controls, manuscript and disposition
Both clean copies pass check.py (small-code enumeration/count identities) and
accepted-check.py (accepted-law controls). These are finite algebra controls;
the quotient/lift/count arguments above carry arbitrary dimensions. The
manuscript M12-radical-attack/main.tex theorem (92), accepted-law lemma (110),
upper-law lemma (164), shortening lemma (247), radical lemma (303), and scope
discussion (345) match the frozen claim. No unsupported transfer to the real
sequential or modified generator was found. Retain the result with that
distributional restriction prominent in any website description.
