========================================================================================
Preset: candidate_depth1_rough  q=65537 n=512 k=3 eta=0.0009765625 n_c=512 m_c=4096 eta_c=6.103515625e-05
Overall best feasible screen: 27.05 bits
These are heuristic screening estimates, not certified security levels.

Instance: sparse_lpn_expansion_key  q=65537 n=512 samples=263169 eta=0.000976562 row_weight=3
  comment: N GSW matrices with N rows each, screening as sparse-LPN samples
  best feasible screen: 27.72 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  warning: very small sparse row weight; use only for tests unless justified by a proof/estimator
  attacks:
    - clean_subset_linear_solve: work=27.72 mem=18.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.7217 bits
    - low_weight_structural_warning: work=45.01 mem=18.01 feasible=yes
      note: row_weight=3 is very small; sparse-LPN security normally requires careful asymptotic growth
    - direct_secret_enumeration: work=8192.01 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=43.73 mem=18.00 feasible=yes
      note: uses t=ceil(eta*m)=258 errors for m=263169 samples
    - modern_isd_floor_screen: work=1.42e+04 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=516.00 mem=512.00 feasible=no
      note: best block=32, levels=16

Instance: code_lpn_compaction_key  q=65537 n=512 samples=2101248 eta=6.10352e-05 row_weight=None
  comment: N CLPN ciphertexts, each with m_c dense q-ary LPN rows
  best feasible screen: 27.05 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  attacks:
    - clean_subset_linear_solve: work=27.05 mem=18.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.04509 bits
    - direct_secret_enumeration: work=8192.01 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=43.05 mem=18.00 feasible=yes
      note: uses t=ceil(eta*m)=129 errors for m=2101248 samples
    - modern_isd_floor_screen: work=1.13e+05 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=420.32 mem=416.00 feasible=no
      note: best block=26, levels=20
========================================================================================
Preset: exploratory_high_noise  q=65537 n=8192 k=2 eta=0.01 n_c=4096 m_c=8192 eta_c=0.01
Overall best feasible screen: 52.00 bits
These are heuristic screening estimates, not certified security levels.

Instance: sparse_lpn_expansion_key  q=65537 n=8192 samples=67125249 eta=0.01 row_weight=2
  comment: N GSW matrices with N rows each, screening as sparse-LPN samples
  best feasible screen: 52.00 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  warning: very small sparse row weight; use only for tests unless justified by a proof/estimator
  attacks:
    - clean_subset_linear_solve: work=157.78 mem=26.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 118.8 bits
    - low_weight_structural_warning: work=52.00 mem=26.00 feasible=yes
      note: row_weight=2 is very small; sparse-LPN security normally requires careful asymptotic growth
    - direct_secret_enumeration: work=1.31e+05 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=173.79 mem=26.00 feasible=yes
      note: uses t=ceil(eta*m)=671253 errors for m=67125249 samples
    - modern_isd_floor_screen: work=3.62e+06 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=n/a mem=n/a feasible=no
      note: no block size gave a finite screening estimate

Instance: code_lpn_compaction_key  q=65537 n=4096 samples=67117056 eta=0.01 row_weight=None
  comment: N CLPN ciphertexts, each with m_c dense q-ary LPN rows
  best feasible screen: 95.39 bits  status=below-128-bit-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  attacks:
    - clean_subset_linear_solve: work=95.39 mem=24.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 59.39 bits
    - direct_secret_enumeration: work=6.55e+04 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=111.39 mem=24.00 feasible=yes
      note: uses t=ceil(eta*m)=671171 errors for m=67117056 samples
    - modern_isd_floor_screen: work=3.62e+06 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=2.50e+08 mem=2048.00 feasible=no
      note: best block=128, levels=32
========================================================================================
Preset: prototype_medium  q=65537 n=512 k=3 eta=9.5367431640625e-07 n_c=256 m_c=1024 eta_c=9.5367431640625e-07
Overall best feasible screen: 24.00 bits
These are heuristic screening estimates, not certified security levels.

Instance: sparse_lpn_expansion_key  q=65537 n=512 samples=263169 eta=9.53674e-07 row_weight=3
  comment: N GSW matrices with N rows each, screening as sparse-LPN samples
  best feasible screen: 27.00 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  warning: very small sparse row weight; use only for tests unless justified by a proof/estimator
  attacks:
    - clean_subset_linear_solve: work=27.00 mem=18.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.0007044 bits
    - low_weight_structural_warning: work=45.01 mem=18.01 feasible=yes
      note: row_weight=3 is very small; sparse-LPN security normally requires careful asymptotic growth
    - direct_secret_enumeration: work=8192.01 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=43.00 mem=18.00 feasible=yes
      note: uses t=ceil(eta*m)=1 errors for m=263169 samples
    - modern_isd_floor_screen: work=1.42e+04 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=340.64 mem=336.00 feasible=no
      note: best block=21, levels=25

Instance: code_lpn_compaction_key  q=65537 n=256 samples=525312 eta=9.53674e-07 row_weight=None
  comment: N CLPN ciphertexts, each with m_c dense q-ary LPN rows
  best feasible screen: 24.00 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  attacks:
    - clean_subset_linear_solve: work=24.00 mem=16.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.0003522 bits
    - direct_secret_enumeration: work=4096.01 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=40.00 mem=16.00 feasible=yes
      note: uses t=ceil(eta*m)=1 errors for m=525312 samples
    - modern_isd_floor_screen: work=2.84e+04 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=180.59 mem=176.00 feasible=no
      note: best block=11, levels=24
========================================================================================
Preset: toy_clean  q=127 n=16 k=2 eta=0.0 n_c=16 m_c=41 eta_c=0.0
Overall best feasible screen: 0.00 bits
These are heuristic screening estimates, not certified security levels.

Instance: sparse_lpn_expansion_key  q=127 n=16 samples=289 eta=0 row_weight=2
  comment: N GSW matrices with N rows each, screening as sparse-LPN samples
  best feasible screen: 0.00 bits  status=toy/broken-screen
  warning: zero noise: no cryptographic hiding against linear algebra
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  warning: very small sparse row weight; use only for tests unless justified by a proof/estimator
  attacks:
    - zero_noise_linear_solve: work=18.99 mem=8.00 feasible=yes
      note: zero noise makes the instance algebraically solvable; toy-only
    - clean_subset_linear_solve: work=12.00 mem=8.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0 bits
    - low_weight_structural_warning: work=16.17 mem=8.17 feasible=yes
      note: row_weight=2 is very small; sparse-LPN security normally requires careful asymptotic growth
    - direct_secret_enumeration: work=111.82 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=0.00 mem=8.00 feasible=yes
      note: zero-error case collapses to linear algebra
    - modern_isd_floor_screen: work=15.61 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=0.00 mem=0.00 feasible=yes
      note: zero noise: BKW unnecessary; linear algebra applies

Instance: code_lpn_compaction_key  q=127 n=16 samples=697 eta=0 row_weight=None
  comment: N CLPN ciphertexts, each with m_c dense q-ary LPN rows
  best feasible screen: 0.00 bits  status=toy/broken-screen
  warning: zero noise: no cryptographic hiding against linear algebra
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  attacks:
    - zero_noise_linear_solve: work=18.99 mem=8.00 feasible=yes
      note: zero noise makes the instance algebraically solvable; toy-only
    - clean_subset_linear_solve: work=12.00 mem=8.00 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0 bits
    - direct_secret_enumeration: work=111.82 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=0.00 mem=8.00 feasible=yes
      note: zero-error case collapses to linear algebra
    - modern_isd_floor_screen: work=37.64 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=0.00 mem=0.00 feasible=yes
      note: zero noise: BKW unnecessary; linear algebra applies
========================================================================================
Preset: toy_depth2  q=127 n=24 k=1 eta=0.0001 n_c=24 m_c=129 eta_c=0.0005
Overall best feasible screen: 13.76 bits
These are heuristic screening estimates, not certified security levels.

Instance: sparse_lpn_expansion_key  q=127 n=24 samples=625 eta=0.0001 row_weight=1
  comment: N GSW matrices with N rows each, screening as sparse-LPN samples
  best feasible screen: 13.76 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  warning: very small sparse row weight; use only for tests unless justified by a proof/estimator
  attacks:
    - clean_subset_linear_solve: work=13.76 mem=9.17 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.003463 bits
    - coordinate_averaging_warning: work=16.28 mem=11.57 feasible=yes
      note: average samples per coordinate is 26.04
    - direct_secret_enumeration: work=167.73 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=20.80 mem=9.17 feasible=yes
      note: uses t=ceil(eta*m)=1 errors for m=625 samples
    - modern_isd_floor_screen: work=33.75 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=17.56 mem=13.98 feasible=no
      note: best block=2, levels=12

Instance: code_lpn_compaction_key  q=127 n=24 samples=3225 eta=0.0005 row_weight=None
  comment: N CLPN ciphertexts, each with m_c dense q-ary LPN rows
  best feasible screen: 13.77 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  attacks:
    - clean_subset_linear_solve: work=13.77 mem=9.17 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.01732 bits
    - direct_secret_enumeration: work=167.73 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=20.77 mem=9.17 feasible=yes
      note: uses t=ceil(eta*m)=2 errors for m=3225 samples
    - modern_isd_floor_screen: work=174.15 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=17.56 mem=13.98 feasible=no
      note: best block=2, levels=12
========================================================================================
Preset: toy_noisy  q=127 n=24 k=2 eta=0.002 n_c=24 m_c=81 eta_c=0.001
Overall best feasible screen: 13.79 bits
These are heuristic screening estimates, not certified security levels.

Instance: sparse_lpn_expansion_key  q=127 n=24 samples=625 eta=0.002 row_weight=2
  comment: N GSW matrices with N rows each, screening as sparse-LPN samples
  best feasible screen: 13.82 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  warning: very small sparse row weight; use only for tests unless justified by a proof/estimator
  attacks:
    - clean_subset_linear_solve: work=13.82 mem=9.17 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.06932 bits
    - low_weight_structural_warning: work=18.46 mem=9.29 feasible=yes
      note: row_weight=2 is very small; sparse-LPN security normally requires careful asymptotic growth
    - direct_secret_enumeration: work=167.73 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=20.86 mem=9.17 feasible=yes
      note: uses t=ceil(eta*m)=2 errors for m=625 samples
    - modern_isd_floor_screen: work=33.75 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=23.97 mem=20.97 feasible=no
      note: best block=3, levels=8

Instance: code_lpn_compaction_key  q=127 n=24 samples=2025 eta=0.001 row_weight=None
  comment: N CLPN ciphertexts, each with m_c dense q-ary LPN rows
  best feasible screen: 13.79 bits  status=toy/broken-screen
  warning: public/evaluation key exposes at least as many samples as the secret dimension
  attacks:
    - clean_subset_linear_solve: work=13.79 mem=9.17 feasible=yes
      note: clean-subset trial exponent without linear-algebra overhead is 0.03464 bits
    - direct_secret_enumeration: work=167.73 mem=0.00 feasible=yes
      note: baseline upper bound on brute-force work
    - prange_isd: work=20.80 mem=9.17 feasible=yes
      note: uses t=ceil(eta*m)=3 errors for m=2025 samples
    - modern_isd_floor_screen: work=109.35 mem=n/a feasible=yes
      note: heuristic red-flag floor inspired by modern binary ISD asymptotics
    - bkw_proxy: work=23.66 mem=13.98 feasible=no
      note: best block=2, levels=12
