Preset: prototype_medium  q=65537 n=512 k=3 n_c=256 m_c=1024
Depth=1 additions=1
Public sample counts:
  expansion_gsw_rows: 263169
  fresh_regev_rows_from_extra_ciphertexts: 0
  total_public_sparse_lpn_rows: 263169
  compaction_lpn_rows: 525312
Sparse row-space diagnostics:
  row_space_log2: 72.407
  public_sparse_rows_log2: 18.006
  birthday_margin_log2: 18.198
  full_space_margin_log2: 54.401
  public_sparse_rows: 263169

Layer: sparse_lpn_gsw_expansion
  dimension=512 modulus=65537 samples=263169 eta=9.53674e-07
  expected_errors=0.250978
  minimum attack cost: 2^25.00 via bkw_block_scan
    - exhaustive_secret_search: time=2^8192.01, memory=2^9.00, samples=2^0.00
      model: try all q^n secrets and test against samples
      caveat: baseline only; ignores algebraic shortcuts and parallelization
    - prange_isd_clean_set: time=2^25.20, memory=2^18.00, samples=2^18.01
      model: C(m,n)/C(m-t,n) clean-set trials plus dense linear algebra
      caveat: rough random-code model; sparse-row structure may change rank and success probabilities
    - low_noise_error_support_search: time=2^59.21, memory=2^18.00, samples=2^18.01
      model: enumerate error positions and q-ary nonzero values, then solve
      caveat: very pessimistic/naive, but useful for detecting dangerously tiny expected error counts
    - bkw_block_scan: time=2^25.00, memory=2^16.00, samples=2^inf
      model: min over block size b=1, levels=512; table q^b plus 1/bias^2 samples
      caveat: coarse first-pass BKW model; ignores advanced coded-BKW and sparse-specific improvements
  warning: expected error count is very small; low-noise attacks and direct decoding deserve special scrutiny
  warning: heuristic attack cost below 80 bits

Layer: qary_lpn_compaction
  dimension=256 modulus=65537 samples=525312 eta=9.53674e-07
  expected_errors=0.500977
  minimum attack cost: 2^22.40 via prange_isd_clean_set
    - exhaustive_secret_search: time=2^4096.01, memory=2^8.00, samples=2^0.00
      model: try all q^n secrets and test against samples
      caveat: baseline only; ignores algebraic shortcuts and parallelization
    - prange_isd_clean_set: time=2^22.40, memory=2^16.00, samples=2^19.00
      model: C(m,n)/C(m-t,n) clean-set trials plus dense linear algebra
      caveat: rough random-code model; sparse-row structure may change rank and success probabilities
    - low_noise_error_support_search: time=2^57.40, memory=2^16.00, samples=2^19.00
      model: enumerate error positions and q-ary nonzero values, then solve
      caveat: very pessimistic/naive, but useful for detecting dangerously tiny expected error counts
    - bkw_block_scan: time=2^24.00, memory=2^16.00, samples=2^inf
      model: min over block size b=1, levels=256; table q^b plus 1/bias^2 samples
      caveat: coarse first-pass BKW model; ignores advanced coded-BKW and sparse-specific improvements
  warning: expected error count is very small; low-noise attacks and direct decoding deserve special scrutiny
  warning: heuristic attack cost below 80 bits

Overall minimum attack cost: 2^22.40 via qary_lpn_compaction:prange_isd_clean_set
Interpretation: toy or weak by this heuristic model
Global warnings:
  - sparse row sample space is close to birthday-collision range; increase n/k/q or seed rows carefully
  - overall heuristic attack cost is below 128 bits
This is a heuristic estimator, not a security proof or certification.
