BREAKING: OpenAI’s solution to Navier–Stokes does not match its Lean verification. The most important article to read today is not one of OpenAI’s 700 AI-generated math papers. It is this other paper, making a deep and worrying point: A Lean-verified proof does not automatically validate the proof written in natural language, nor does it mean that the formal statement captures the intended theorem. During translation, an AI can change an assumption, weaken a statement, or replace the argument entirely. It can hallucinate another theorem. Lean correctly verifies the result. But the proved result may no longer be what the paper claims. This is a general problem. Things get spicy when the authors examine OpenAI’s proposed Navier–Stokes solution. They identify at least two mismatches between the written intermediate results and their Lean counterparts: One estimate claims that four additional input derivatives suffice. The Lean version requires five: a weaker result. A pressure-flux estimate is obtained through a different bound, and proved through a different argument. It is not clear whether these mismatches invalidate the entire proof. But they raise an important issue. OpenAI is flooding us with claimed revolutionary breakthroughs. Yet nobody knows whether the proofs are correct or whether they prove what they claim to be proving. Epistemia at scale. * Paper in the first reply

New paper on how to securely instantiate Fiat-Shamir using VRFs. This is a joint work with @RiddhiGhosal (Nokia Bell Labs) @aniketpkate (Mysten Labs) @pratyaycrypto (Hashgraph), and @sinharo (Hashgraph). The idea seems simple but the proofs are extremely complicated. Kudos to @RiddhiGhosal for taking the lead on that.

I am happy to announce our work "Practical Post-Quantum Secure Publicly Verifiable Secret Sharing and Applications" has been accepted at ACM PQQS 2026. ( In this work, we show that in a publicly VSS with a non-interactive dealer, NIZKs(for correct dealing) can be completely avoided by combining lattice-based IBE + a verifiable complaint phase between the receivers. This removes the necessity for a lattice-based NIZK for post-quantum PVSS and is useful for post-quantum secure applications over the blockchain. This is a joint work with @aniketpkate (Mysten Labs) @pratyaycrypto (Hashgraph) @sinharo (Hashgraph) and @thehumzasaleem. Paper link:

Very interesting work by @guruvamsip @commonwarexyz to obtain Batch decryption using pairings + high school algebra: 1. Each client chooses a random k_i, encrypts their message under k_i^2 and the validator's pk in the target group. Each client also provides pk.k_i^2, and k_i in group 1 and group 2. 2. The validators decrypt the sum of all the encrypted k_i's (denote it as K) by sending a single decryption share. 3. Given the decryption of K^2 as pk.K^2 one can compute the individual pk.k_i^2 as follows: (Ignore the pk for now) K^2 =(k_1 + k_2 + k_3)^2 = k_1^2 + k_2^2 + k_3^2 + cross terms. (This omits a lot of crucial details for simplicity) Suppose you want to decrypt the message under k_i^2 using K^2: 1. The cross terms can be removed by combining k_i in g_1 and k_j in g_2 (and vice versa) using pairings for all j!=i. This allows to remove the cross terms. 2. Then the individual pk.k_j^2 can be removed by using the client-provided material. The brilliance lies in figuring out the optimal amount of information to put into the ciphertext, which allows the cross-term removal (using pairings) while preventing an adversary from decrypting the client ciphertexts without the decryption of the sum K. Kudos on the great work!

Compute Polynomials Twice as Fast - Here's a fun result, done entirely without AI. That because we proved it years ago, but it ran a hundred pages and we weren't quite sure enough to publish. Now AI verified it in Lean. A fun fact about polynomials is that P(x) = x⁴ + a₃x³ + a₂x² + a₁x + a₀ can be evaluated in just two(!) multiplications! The trick is to write y = (x + b₀)x + b₁ P(x) = (y + x + b₂)y + b₃ where b₀…b₃ are easy to calculate from a₀…a₃. Polynomials are everywhere from computing exp/sin, to cryptographic hashes and codes. Over finite fields multiplications are particularly expensive, so a 2x speedup matters. Donald Knuth and others showed ~n/2 multiplications suffice for any degree n, but their preprocessing needs complex roots: numerically unstable and useless over finite fields. Rabin & Winograd fixed that with rational preprocessing, but 2logn extra multiplications, which hurts at the small n we most care about. Our new method solves this. It uses ⌈(n+1)/2⌉ multiplications, and we prove this is optimal. You can try it out on your own polynomials at