The setting, informally

You have a hash function that is a random oracle, taking a seed and an input and returning . You want to look uniformly random. Classically you get that from a leftover hash lemma: if has enough entropy and the seed is fresh, the output is close to uniform.

Two things make this version harder than the classical one.

The source sees the whole oracle. The adversarial process that produces is handed the entire function table of before it chooses. So is not independent of the extractor; it can be chosen because of what does. All you assume is that is hard to guess: no unbounded predictor, given the table and whatever side information came with , guesses with probability better than .

The seed might be public. In one game the distinguisher gets ; in the other it does not. Both games are in the same source document, as Conjectures 1 and 2. The secret-seed one is now c/0005; the public-seed one is c/0004.

For the secret seed, the conjectured bound is

with , , the sizes of the seed, input and output sets. Everything is under one square root, and the whole thing decays like . Buy a bigger seed space, get a better bound.

The obvious guess, and why it is wrong

The obvious thing to try for the public-seed game is to keep that expression and change nothing:

This is false, and it fails badly. Here is the whole counterexample.

Take : as many outputs as inputs. Let the source be as good as a source can possibly be: uniform on all of , with no side information at all. Now the distinguisher is handed , so it can compute the entire row

for every at once. It has and it has ; nothing is hidden. So it collects the image of that row, and asks one question about its challenge : is in the image?

If the challenge is real, for some , so the answer is yes with certainty. If the challenge is uniform, the answer is yes only if happens to land in the image. A uniformly random function from a set of size to a set of size misses roughly a fraction of its codomain, so the answer is no about 37% of the time. That gap is the distinguisher’s advantage: it is at least , and it does not depend on at all.

Meanwhile the right-hand side of the guessed bound does depend on : fix everything else and let the seed space grow, and it goes to zero. So there is no universal constant that makes it true. The guess is not off by a constant; it is the wrong shape.

What went wrong, in one sentence

Once the seed is public, the seed’s entropy stops being entropy.

In the secret-seed game the distinguisher does not know which row of it is looking at, and that uncertainty is worth bits that help against everything. In the public-seed game it knows exactly which row, so the only randomness left in the challenge is whatever was in itself. No amount of extra seeds repairs that, because the attack above never used a lack of knowledge about the seed.

The corrected bound, and the price

The corrected statement moves one term out from under the :

Compare the two shapes:

	secret seed	public seed
entropy deficiency,	inside the	outside the
adversarial support choice,	inside the	inside the

That is the whole price, and it is worth being precise about how narrow it is. Publishing the seed costs exactly one factor of , and it costs it in exactly one summand. The term, which measures how far the source is from having full entropy, no longer improves when you enlarge the seed space, because that is the term the image-membership attack goes after. The second term, which is about the adversary getting to choose which support to attack after seeing , keeps its in full: that one really is helped by having more seeds, because it is about a choice made before the seed is revealed.

The upshot is that the conjectured form does hold, with ; the best constant this route gives is about , and covers every case. So c/0004 is marked research-solved.

Why the badge still looks unimpressive

The statement is proved, and the page’s badge still reads low. That is deliberate and it is not a bug.

The badge grades formal and mechanized progress, not whether someone believes the result. The proof is an AI draft that nobody has independently reviewed, so the proof grade sits at pi = 1. As of this run the statement is formalized in Lean with an AI match check, which moves the statement ring but not the disc; the proof itself is not formalized, and the Lean file’s one sorry is exactly the theorem this post is about.

Two things would move it, and neither is something an AI can do for itself: a human reading the proof and putting their name to it, and a human checking the Lean statement against the informal one. Until then the badge says what is actually known, which is the point of having it.