Preset: c2_toy_noisy  target=128.0 bits
C2 block size: 2  dictionary entries: 390
Public CLPN rows: 37830  within-entry diffs: 1815840  cross-entry diffs: 85047951
Seeded storage proxy: dense=945750 field elements, seeded=38220 field elements, reduction=24.74x
Minimum finite screen bits: 0.00
Passes screening target: False
Attack screens:
  - clean-subset linear solving [GSW/sparse-LPN expansion-key row screen]: bits=0.01 status=critical
    289 row-level objects, dimension 16, eta=0.0005.
  - Prange information-set decoding [GSW/sparse-LPN expansion-key row screen]: bits=0.00 status=critical
    First-order decoding estimate using the expansion-key row count.
  - BKW-style noisy-linear learning [GSW/sparse-LPN expansion-key row screen]: bits=8.61 status=critical
    Coarse q-ary BKW screen; specialized sparse-LPN estimators remain required.
  - within-entry clean-subset solving [C2 CLPN dictionary, message-eliminating row differences]: bits=0.03 status=critical
    1815840 within-entry difference rows, dimension 24, eta_eff=0.000999708.
  - within-entry Prange/ISD screen [C2 CLPN dictionary, message-eliminating row differences]: bits=0.03 status=critical
    Random-code decoding proxy on row-difference samples from each dictionary entry.
  - within-entry BKW-style screen [C2 CLPN dictionary, compaction secret r]: bits=11.42 status=critical
    Coarse BKW screen for the q-ary LPN compaction secret under difference noise.
  - cross-entry clean-subset solving [C2 block dictionary, joint secret (r, s_block)]: bits=0.04 status=critical
    85047951 cross-entry difference rows inside blocks, joint dimension <= 26, eta_eff=0.000999708.
  - cross-entry Prange/ISD screen [C2 block dictionary, joint secret (r, s_block)]: bits=0.04 status=critical
    First-order decoding proxy for relations induced by differences of dictionary entries in the same block.
  - cross-entry BKW-style screen [C2 block dictionary, joint secret (r, s_block)]: bits=11.59 status=critical
    Coarse BKW screen on the enlarged q-ary LPN instance with dimension n_c + block_size.
  - sparse-row collision entropy [expansion row-distribution sanity screen]: bits=6.58 status=collision-risk
    sparse row entropy 6.58 bits; birthday excess log2(samples)-H/2=4.88.
  - seeded-storage does not reduce samples [C2 seeded dictionary storage model]: bits=24.74 status=informational
    seeded A representation reduces dense dictionary storage by about 24.74x in this proxy, but public b rows remain 37830; attack screens are unchanged.
Blockers:
  - GSW/sparse-LPN expansion-key row screen: clean-subset linear solving at 0.01 bits (critical)
  - GSW/sparse-LPN expansion-key row screen: Prange information-set decoding at 0.00 bits (critical)
  - GSW/sparse-LPN expansion-key row screen: BKW-style noisy-linear learning at 8.61 bits (critical)
  - C2 CLPN dictionary, message-eliminating row differences: within-entry clean-subset solving at 0.03 bits (critical)
  - C2 CLPN dictionary, message-eliminating row differences: within-entry Prange/ISD screen at 0.03 bits (critical)
  - C2 CLPN dictionary, compaction secret r: within-entry BKW-style screen at 11.42 bits (critical)
  - C2 block dictionary, joint secret (r, s_block): cross-entry clean-subset solving at 0.04 bits (critical)
  - C2 block dictionary, joint secret (r, s_block): cross-entry Prange/ISD screen at 0.04 bits (critical)
  - C2 block dictionary, joint secret (r, s_block): cross-entry BKW-style screen at 11.59 bits (critical)
  - expansion row-distribution sanity screen: sparse-row collision entropy at 6.58 bits (collision-risk)
Seeded C2 reduces storage/materialization cost only.  It does not reduce public-sample exposure. The cross-entry dictionary-difference surface should be treated as a mandatory cryptanalysis item.
Screening estimate only; not a certified sparse/q-ary-LPN security estimator or a proof of insecurity. It is designed to catch regimes that are obviously unsuitable before detailed cryptanalysis.
