professor of computer science at @Yale | co-director of @YaleACL | chief scientist at @lagrangedev | researching and teaching cryptography and security

New Haven, CT
Joined May 2015
Impressive!
Dolev–Strong is arguably the most well-known consensus protocol, yet in about 45 years no deterministic protocol improved on its O(n^3) communication. With @komasito55 & Ling Ren, we get O(n^2 log^4 n) for Byzantine Broadcast, t<n faults, O(t) rounds: eprint.iacr.org/2026/2504
9
1,367
Charalampos (Babis) Papamanthou retweeted
This podcast from @a16zcrypto includes an aspect that hasn't been stressed enough. In the end, AI cryptanalysis is a great thing for cryptography as it helps us gain confidence in new assumptions, key sizes (e.g. for new PQ schemes) and more. youtube.com/watch?v=k_CoOoDs…
6
17
2
128
18,830
Charalampos (Babis) Papamanthou retweeted
Replying to @a16z
Formal verification of functional correctness is quickly becoming the bare minimum standard. It will soon be irresponsible for any enterprise to release code which is not formally verified. AI coding agents can generate not only the code, but also a spec with a proof that the code satisfies the spec. Or put simply, if it is so smart to generate the code, it should also be smart enough to tell me what it did and give me all the verifiable evidence that it did it. This used to be hard, but it is not anymore. The spec, any spec, forces the agent to reflect on its code symbolically and prove some properties about it. That will make it write better code and solve more challenges. Same like humans. The spec can and should include the known security attack vectors, for starters. There will always be unknown unknowns, but known unknows are not an option anymore, as they will be instantly exploited. Generating formally verified code is possible now. The agents can do it with the adequate harness and proving infra, at no extra effort from the devs.
2
2
17
721
1/ While preparing our CCS 2026 presentation for our DeepProve project at @lagrangedev, one application we have been thinking about is proving AI safety benchmarks without disclosing the model.
2
4
25
2,418
6/ Note that the same zk primitive generalizes to other committed-model claims (upcoming work) such as fairness and robustness metrics and bias evals over any public labeled dataset.
1
1
141
7/ For more information on the technical aspects of the @lagrangedev DeepProve project, see our paper eprint.iacr.org/2026/1112.
3
146
This work led by @alrshirzad while interning at @lagrangedev has been accepted to TCC 2026! Congratulations!
Most SNARKs encode computations into finite fields. Snarking integer arithmetic needed, for example, in ML and RSA, incurs a big overhead. Our new paper with the @lagrangedev research team builds SNARKs that work with integers natively---see our new paper eprint.iacr.org/2026/347!
2
2
17
1,792
Indeed, the @lagrangedev research team used the "certify-instead-of compute" approach to avoid the quadratic cost. Our certification algorithm verifies output tokens are correct given input tokens and via a single inference. See Section 3.1 of our paper eprint.iacr.org/2026/1112.pd….
Replying to @lagrangedev
the quadratic thing was the wall for years. everyone knew the obvious fix was kv caching and everyone also knew it makes proving worse, not better. @chbpap and the team got around it instead of through it. proud of this one.
2
4
914
Most SNARKs encode computations into finite fields. Snarking integer arithmetic needed, for example, in ML and RSA, incurs a big overhead. Our new paper with the @lagrangedev research team builds SNARKs that work with integers natively---see our new paper eprint.iacr.org/2026/347!
5
10
2
69
6,807
Charalampos (Babis) Papamanthou retweeted
This is quite a remarkable result: Posed in 1939, the Jacobian conjecture is one of the central open problems in algebraic geometry, but was just disproved by Alpoge, Matthew, and Claude Fable 5. The Jacobian conjecture roughly says that a multivariable polynomial F has an inverse function (made out of polynomials) provided the Jacobian is non-singular (i.e. matrix of partial derivatives has non-zero determinant). This condition is neccessary by the Inverse Function Theorem from multivariable calculus. The hard question is whether it is also sufficient. Evidently, Fable found that F(x,y,z) = ((1+xy)^3 z + y^2 (1+xy) (4+3xy), y + 3 x (1+xy)^2 z + 3 x y^2 (4+3xy), 2 x - 3 x^2 y - x^3 z) has det(J_F) = -2 non-zero. However F is not invertible, since F sends three different pts (0, 0, -1/4), (1, -3/2, 13/2), and (-1, 3/2, 13/2) to the same image (-1/4, 0, 0). Beyond the disproof itself, it would be value to know if a suitably refined conjecture is recoverable. Per @Acer, GPT5.6 has proposed: "A constant-Jacobian polynomial local biholomorphism with no loss of sheets at infinity—e.g. a proper Keller map—is an automorphism." I would be interested to know if any algebraists (e.g. @levent @littmath) have a reaction to this... A further twist to the story: Not only was the Jacobian conjecture one of the central open problems in algebraic geometry, it was (a special case of) Yitang Zhang's PhD problem! The catch was that Zhang's advisor had him solve it, assuming a lemma of his advisor. But that lemma turned out to be false! As a result, Zhang's thesis crumbled and he then struggled to get recommendation letters and a permanent academic position. Despite all this, Zhang went on to prove bounded gaps between primes! This is one of the most inspiring stories in modern mathematics, and was a motivation for me to work in the same area for my doctorate.
hello there the jacobian conjecture is false thanx to my close friend akhil for asking about it and my other close friend fable for working during the world cup final ((1+xy)^3 z + y^2 (1+xy) (4+3xy), y + 3 x (1+xy)^2 z + 3 x y^2 (4+3xy), 2 x - 3 x^2 y - x^3 z): \C^3\to \C^3, has jacobian determinant -2, and sends (0, 0, -1/4), (1, -3/2, 13/2), and (-1, 3/2, 13/2) to (-1/4, 0, 0)
59
400
84
2,946
650,680
Brand new work at @lagrangedev! We introduce a coordination library for low-compute nodes via local blockchains linked into a cross-chain DAG. Every node can locally query both what it knows and what any peer subset agrees on. We support crash-fault & plan to explore Byzantine.
In a real fight, no single drone sees everything. Sensors disagree. Maps drift. Each one thinks it knows what's happening, and they're all a little wrong. Halo pulls them into one shared picture the whole swarm acts on together. Not a vote. One converged view of what's true. One swarm. One shared picture.
1
8
1,273
1/ At @lagrangedev, we have been working on ZK since 2022. Our team has published or submitted 12 papers at the top venues in cryptography and security: CCS, IEEE S&P, EUROCRYPT, CRYPTO, USENIX Security, FC, SBC. Here is my summary.
2
3
35
3,319
13/ Finally, verifiable data infrastructure: Perseus--- Verifiable SQL via Decomposition (in preparation). Run SQL over untrusted databases and get a proof the answer is correct.
1
336
14/ We are innovating updatable/distributed proofs, verifiable AI and verifiable data, feeding production systems like DeepProve. Looking forward to more innovation in research/engineering at @lagrangedev! Happy 4th!
292