Mhoc Yar retweeted
18 of the 20 best open models today are Mixture-of-Experts. Dense is basically over.
And yet the know-how to train a good MoE still lives mostly in the heads of a handful of teams.
So we spent 800k GPU hours running the experiments ourselves and wrote everything down. Super happy to finally release "The Ultimate MoE Training Handbook", free and open, organized around the questions training teams hit:
- how many experts, how big, shared or not?
- why is half my step spent in all-to-all, and how do I hide it?
- why is my run 25x slower with no error in the logs?
- softmax, sigmoid or sqrt(softplus) router, and why keep it in fp32?
- aux loss or DeepSeek's loss-free bias?
- upcycle a dense checkpoint or train from scratch?
- can I serve with fewer experts per token than I trained with?
⚠️ Warning: it's long (~70k words, budget a few days, sorry) but with 55 interactive figures, code you can run and numbers from our own runs.
Read it here: huggingface.co/spaces/huggin…
Whenever P = NP is proven, our simulation must be reset
🤖ETH (not Ethereum but the Exponential Time Hypothesis) is false.
A Lean proof, produced by OpenAI says 3-SAT can be solved in subexponential time.
For twenty-five years the field assumed the opposite, and hundreds of "impossible unless ETH fails" results in graphs, biology, databases, and geometry were deduced from a false premise.
The problems are not suddenly easy. We have simply lost a fundamental reason we had for refusing to look for a faster algorithm. Sorry, your SAT solver does not get faster.
ETH was the strong form of P ≠ NP. Every polynomial is already subexponential, so a true ETH would have implied P ≠ NP immediately. A false ETH does not imply P = NP. Subexponential is still FAR more than polynomial.
This has no impact on cryptography. Signatures, hashes, discrete logs, and lattices are average-case questions about specific functions. A faster worst-case algorithm for Boolean formulas does not forge a signature, invert SHA-256, or change the cost of a Bitcoin block.
Classical cryptography needs one-way functions, and those cannot exist if P = NP.
Whenever P = NP is proven, our simulation must be reset.
Solo authoring a paper on a ZKVM that is >10x SOTA is nuts. Congrats @srinathtv
Introducing Magnetar from Microsoft Research, the first zkVM that is: (1) general-purpose (RV64), (2) post-quantum from standard hashes alone (no curves, no lattices, no Poseidon), and (3) built for recursion.
Despite its conservative security, it is the fastest zkVM: 7.2–8.7 MHz on a laptop, 10–39× faster than existing zkVMs across 15 workloads! An optimized version reaches 9.5–12.8 MHz.
Links in the thread below.
Mhoc Yar retweeted
Worth checking the status of AI-assisted lattice cryptography results. There will definitely be more progress until the end of this year. OpenAI and Anthropic results not yet out.
Status after a month is that eprint has reached three papers from two teams claiming exponents on the scale of n / ln ln n: eprint.iacr.org/2026/2261, eprint.iacr.org/2026/2289, eprint.iacr.org/2026/2386
Mhoc Yar retweeted
Impressive work from the recent math drops, the unit-distance counterexample, the sub-n log n multiplication result, and the 3SUM/APSP improvements are genuinely humbling for prior intuitions.
That said, treating a classical ECDSA break in months as a planning baseline still looks like FUD.
A practical private-key recovery attack on secp256k1 (or similar curves) on available hardware would not stay confined to Bitcoin and Ethereum. It would compromise TLS, code signing, most banking systems, and a large fraction of deployed public-key infrastructure at once.
Hash-based schemes are attractive precisely because they minimize algebraic structure, but the same loss of mathematical intuition that motivates caution on curves also applies to hashes ;-)
A calm hygiene improvement (avoiding address reuse after the first signature) is reasonable for large holders, and all good wallets incentivizes using new addresses.
But calling for a “mass migration” would create operational mistakes that lose funds with higher probability than the scenario being mitigated.
We already have a Post Quantum migration to execute, let's not add more confusion.
Today I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.
Holders, starting with large and sophisticated ones, should consider moving the bulk of their funds to addresses that have never signed a transaction. And when they do sign one, they should also move remaining funds to a new address (possibly generated from the same seed phrase).
Don't rush. While I believe there is cause for action a rushed migration would do more harm than good. Don't panic either. Moving assets to protected addresses is a simple, preventative step which does not require new cryptography or new wallets.
IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. By "break" I mean fast private key recovery (e.g. in one week) on available hardware (e.g. a large GPU cluster).
Recent days have been humbling for human mathematical intuition. Long-held, unquestioned hypotheses have fallen. This includes the n log(n) bound for integer multiplication and the 3SUM conjecture. In hindsight, May's unexpected disproof of the Erdős unit distance conjecture was our warning shot.
Yesterday's OpenAI drop made it clear that mathematical superintelligence is upon us. They say there are weeks where decades happen. We are about to live through weeks where centuries of mathematical progress happen. Could our magic 64-byte ECDSA signatures be too good to be true? Was it just security through obscurity all this time?
Elliptic curves feel especially vulnerable to superintelligence. Curves carry rich structure, with room for fancy tricks like Schoof, Frobenius, pairings. (By contrast, hashes are designed to minimise algebraic structure.)
Separately, as Ewin Tang can attest, an efficient quantum algorithm sometimes foreshadows an efficient classical one. We should be open to the possibility of a classical counterpart to Shor that breaks elliptic curves and RSA at once.
Also noteworthy is the striking under-representation of cryptographic breakthroughs among the 722 mathematical results OpenAI published. I've witnessed first-hand the US government censoring academic quantum cryptanalysis results. Backroom interventionism is my base case.
I urge large, sophisticated actors to lead by example. Project11's "risq list" (bitcoin-risq-list.projecteleven[.]com) is a great tracker of exposed BTC pubkeys. Binance, Bitbank, Robinhood, Bitfinex, and Tether have an opportunity to harden their cold storage. Next month I'll address institutions in London in a live Q&A (forum.ethereuminstitutional[.]org/london-2026).
Again, please do not rush. Wallets holding under 50 BTC enjoy partial cover from "Satoshi's shield", i.e. his 20K exposed addresses that hold 50 BTC each. Load-bearing signers like oracles and L2 security councils should consider rotating ECDSA pubkeys with every signed message and/or multi-signing with a hash-based schemes like SPHINCS.
Exiting bunker mode safely will require post-AI cryptography. My inclination is to go all-in on hash-based cryptography and avoid structured mathematical assumptions entirely, whether from curves, lattices, or isogenies. A single battle-tested hash (e.g. from the SHA or BLAKE families) yields plausible post-AI security.
The Ethereum roadmap on strawmap[.]org fully embraces hash-based cryptography with end-to-end formal verification as a response to the quantum threat. Those timelines must now be revisited and accelerated in light of mathematical superintelligence. I'll be pushing for maximum defensive acceleration.
Mhoc Yar retweeted
The hardest problem in distributed systems (and database design) is hot rows.
In other words, serialization w.r.t. data accesses while preserving application correctness (e.g. ACID).
But hot rows is also what separates (and accelerates) TigerBeetle from most systems…
Even if your database is infinitely fast and infinitely parallel you can’t hack your way around network round-trip time and contention, where multiple transactions force you to lock your hot rows.
This is Amdahl’s law applied to transaction processing and it’s why even at just 10% contention, your throughput drops not by 10%, but 10X.
@jorandirkgreef describes this fundamental flaw in the SQL transaction interface 👇
@TigerBeetleDB #OLTPforthenext30years
Mhoc Yar retweeted
We spent the last few days testing JEV internally. We tried to reproduce it, break it, and improve it.
5 things we learned:
1. JEV’s core insight is simple - and probably right. If the answer space is bounded, don’t generate the answer token by token. Remove autoregressive decoding and you can remove 1–2 orders of magnitude of inference work.
2. RLCD isn’t the moat. Data might be. Laya already open-sourced the implementation + weights. The missing piece is the synthetic data recipe. And our experiments strongly point in the same direction.
3. “Open source already beat JEV” is a benchmark illusion.
Same checkpoint:
In-distribution: 0.769
OOD: 0.541
Change the distribution and the apparent breakthrough largely disappears.
4. Compute-optimal ≠ learnability-optimal.
We moved state outside the problem sequence to save compute. Result: -27 points. Likely because we saved FLOPs while throwing away useful MLM pretraining priors.
Then we tested 6 more ideas in one night: anchor selection, continuity smoothing, asymmetric windows, bucketed temperature, two-stage retrieval, full RLCD.
All failed or failed to generalize. Only one thing consistently worked: More data.
1,200 → 123,475 examples
OOD: 0.4069 → 0.5498
5. The weirdest result: A decoder with zero additional training still beat every trained small encoder:
0.5671 vs 0.5628 / 0.5411 / 0.4069
Our takeaway: JEV’s breakthrough may not be a particular architecture or training algorithm.
It may be a much simpler idea: When the answer space is bounded, search it. Don’t generate it. And right now, the biggest bottleneck to making that work broadly doesn’t look like architecture.
It looks like data.
Mhoc Yar retweeted
Cybersecurity this, cybersecurity that... meanwhile actual cybersec folks do not have access to the Cyber Models. Only AI folks & Threat Actors. The actual experts who have been doing all the work in this domain are not inculded in talks. Great. Just fantastic.
We Must Pace the Frontier: I’ve written a new essay on why the AI industry should slow down, with a three-part plan for doing so.
Anthropic is unilaterally committing to the first of these steps. We’ll provide third-party evaluators with permanent, employee-level access to our systems, so that they can verify adherence to our safety measures, report on incidents, and assess models’ alignment during training.
You can read the full post here: darioamodei.com/post/we-must…
Mhoc Yar retweeted
Fast and scalable private payments. Now available on your favorite blockchain.
Introducing Bonsai, @commonwarexyz’s new protocol for efficient encrypted transfers (hidden balances, amounts, and recipients) with no global nullifier set.
Mhoc Yar retweeted
1/ Today we're releasing Lattice Jolt: a post-quantum version of the Jolt zkVM, built on lattices instead of elliptic curves. It's _faster_ than curve-based Jolt and has the shortest proofs of any post-quantum zkVM — under 100 KB.
Post: a16zcrypto.com/posts/article…
Mhoc Yar retweeted
New work out! We (royally) show that Fiat-Shamir transformation is insecure for a class of proof systems for *generated* relations (including variants of commonly deployed protocols for R1CS).
A thread to explain where this applies
ia.cr/2026/1838
Mhoc Yar retweeted
Having read some more of the Hugging Face incident I have lots of thoughts but also: wtf is going on with OpenAI security? Are they even awake?
Mhoc Yar retweeted
Broken post-quantum hash function Spinel. It's based on a hard problem for quantum computers. But it turns out that is easily breakable by a non-quantum computer (without attacking the "hard problem") ;) arxiv.org/pdf/2608.21986
Mhoc Yar retweeted
This is a project we built internally to prevent agents from going rogue. Think of it as a governance layer for AI agents inside your org! We decides to spin it out as its own project as we want it to be completely free, open source and owned by the community!
We are open sourcing Umbra, an isolated cloud environment for AI agents.
github.com/concrete-security…
Umbra came from a internal need at Zama where we wanted to use agents across the company without giving them more access than they actually needed.
Agents can write code, install software, read internal data, use credentials and interact with production systems. As they get more capable, it becomes unrealistic to review everything they do step by step.
So the idea behind Umbra is simple: put the agent in a box. Give it a machine, let it work inside, and focus on what happens at the boundary.
The VM is theirs. The edge is ours.
Anything that touches github, slack, notion, internet, production or any other external system goes through a controlled proxy. That is where we apply policy.
Can this agent access this repo? Is github read-only? Can it push code? Can it reach production? Which credential does it need?
We grant access only when needed, and secrets are injected only for the operation being authorized.
The same applies to what comes out. Code, data or actions can be checked before they leave the environment.
Umbra is still experimental, but the key idea is: give agents enough freedom to be useful, assume they will sometimes make mistakes, and keep tight control over the boundary.
Agents can be unpredictable and most likely will always be. Boundary shouldn't be.
Mhoc Yar retweeted
I, Ben, and the Irreducible team obsessed for years to make binary fields SNARKs happen, and I'm really proud that our work played a part in shaping Ethereum's direction.
We were far from the only ones though. A few others whose work on binary fields pushed Binius forward
The legacy of Binius will continue on - as people retreat to hash-based systems which are the only ones seemingly safe from future quantum attackers, proof systems over binary fields built for proving traditional hashes will be the new standard.
@benediamond & @jimpo_potamus were way ahead of this.
Mhoc Yar retweeted
Nvidia recently added carryless multiplication instructions! developer.nvidia.com/blog/bu…
Time to come back to your first love :-)
